Does mysql client validate the CA chain?

MySQL & MariaDB Percona Server for MySQL 5.7
1

I am running Percona Server 5.7.35-38 and using the mysql client from Percona-Server-client-57-5.7.35-38.1.el8.x86_64. I have created a user which requires ssl and configured the server with server certificate, key and ca certificate.
I am finding that making an encrypted connection with “mysql -u user -p -h --ssl-ca --ssl-mode=VERIFY_CA” always works, regardless of the CA cert I am specifying.
This seems to imply that the mysql command is not validating the CA chain - is this expected behaviour?

2

You may want to check the [mysql] or [client] sections of your .cnf file to see if an ssl-ca file path is already defined.

3

There’s nothing like that in the client’s .cnf file.
I’ve also tested with mysql from percona-server-client-8.0.42-33.1.el8.x86_64, and that version does check the CA chain.