# Does mysql client validate the CA chain? **URL:** \ **Category:** Percona Server for MySQL 5.7\ **Created:** [July 30, 2025, 3:48pm UTC](https://forums.percona.com/t/does-mysql-client-validate-the-ca-chain/38893 "2025-07-30T15:48:26Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![chris-card](https://avatars.discourse-cdn.com/v4/letter/c/5fc32e/32.png) [@chris-card](https://forums.percona.com/u/chris-card)\ **Post date:** [July 30, 2025, 3:48pm UTC](https://forums.percona.com/t/does-mysql-client-validate-the-ca-chain/38893/1 "2025-07-30T15:48:26Z")
I am running Percona Server 5.7.35-38 and using the mysql client from Percona-Server-client-57-5.7.35-38.1.el8.x86\_64. I have created a user which requires ssl and configured the server with server certificate, key and ca certificate. I am finding that making an encrypted connection with “mysql -u user -p -h --ssl-ca --ssl-mode=VERIFY\_CA” always works, regardless of the CA cert I am specifying. This seems to imply that the mysql command is not validating the CA chain - is this expected behaviour? ---
**Author:** ![Abhinav\_Gupta](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/abhinav_gupta/32/6262_2.png) [@Abhinav\_Gupta](https://forums.percona.com/u/Abhinav_Gupta)\ **Post date:** [July 31, 2025, 3:42pm UTC](https://forums.percona.com/t/does-mysql-client-validate-the-ca-chain/38893/2 "2025-07-31T15:42:22Z")
You may want to check the `[mysql]` or `[client]` sections of your `.cnf` file to see if an `ssl-ca` file path is already defined. ---
**Author:** ![chris-card](https://avatars.discourse-cdn.com/v4/letter/c/5fc32e/32.png) [@chris-card](https://forums.percona.com/u/chris-card)\ **Post date:** [July 31, 2025, 3:52pm UTC](https://forums.percona.com/t/does-mysql-client-validate-the-ca-chain/38893/3 "2025-07-31T15:52:04Z")
There’s nothing like that in the client’s .cnf file. I’ve also tested with mysql from percona-server-client-8.0.42-33.1.el8.x86\_64, and that version does check the CA chain.