# Enforcing mTLS with ProxySQL **URL:** \ **Category:** Percona Operator for MySQL\ **Created:** [October 12, 2025, 11:55am UTC](https://forums.percona.com/t/enforcing-mtls-with-proxysql/39536 "2025-10-12T11:55:49Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![vis21](https://avatars.discourse-cdn.com/v4/letter/v/e0b2c6/32.png) [@vis21](https://forums.percona.com/u/vis21)\ **Post date:** [October 12, 2025, 11:55am UTC](https://forums.percona.com/t/enforcing-mtls-with-proxysql/39536/1 "2025-10-12T11:55:49Z")
## Description: Attempting to enforce mTLS using ProxySQL. In values, I have tls enabled: ```auto tls: enabled: true ``` I’ve set the interfaces ssl\_verify\_client and ssl\_required as well as have\_ssl. ```auto interfaces="0.0.0.0:3306:ssl_cert=/etc/proxysql/ssl/tls.crt:ssl_key=/etc/proxysql/ssl/tls.key:ssl_ca=/etc/proxysql/ssl/ca.crt:ssl_required=1:ssl_verify_client=1;0.0.0.0:33062:ssl_cert=/etc/proxysql/ssl/tls.crt:ssl_key=/etc/proxysql/ssl/tls.key:ssl_ca=/etc/proxysql/ssl/ca.crt:ssl_required=1:ssl_verify_client=1" have_ssl=true ``` I was able to confirm configuration got applied by querying the database: ```auto mysql> SELECT * FROM runtime_global_variables WHERE variable_name='mysql-interfaces'; +------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | variable_name | variable_value | +------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | mysql-interfaces | 0.0.0.0:3306:ssl_cert=/etc/proxysql/ssl/tls.crt:ssl_key=/etc/proxysql/ssl/tls.key:ssl_ca=/etc/proxysql/ssl/ca.crt:ssl_required=1:ssl_verify_client=1;0.0.0.0:33062:ssl_cert=/etc/proxysql/ssl/tls.crt:ssl_key=/etc/proxysql/ssl/tls.key:ssl_ca=/etc/proxysql/ssl/ca.crt:ssl_required=1:ssl_verify_client=1 | +------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 1 row in set (0.00 sec) ``` However, I can still connect using invalid certs or with no certs at all. ## Steps to Reproduce: Pretty much as above, apply the same values and attempt to connect without certs or with invalid certs. ## Version: ProxySQL version 2.7.3-percona-1.1, codename Truls ## Logs: N/A ## Expected Result: Unable to connect when not using certs or using invalid certs. ## Actual Result: Able to connect when not using certs or using invalid certs. ## Additional Information: I’ve found the below: > > > Hello, > do you plan to make SSL/TLS client authentication on the frontend? > … and disable non SSL connections on it? > > Thank you! > **[SPIFFE Support - ProxySQL](https://proxysql.com/documentation/spiffe-support/)** > > Configuration and usage of SPIFFE authentication in ProxySQL, including setting user attributes, enabling regex for spiffe\_id, and integrating intermediate CA certificates. with the important note: **Important Note:** ProxySQL doesn’t support mTLS support for SSL connections, it’s **just in case** a client connection supplies a certificate which holds a _SAN URI identifier_ starting with ‘ **spiffe** ‘, like in the previously given example, that ProxySQL will perform the verification of the client certificate against _proxysql-cert.pem_. I think I can safely assume the operator doesn’t support it either, however maybe I’m wrong. If I’m not, I’d like to find out if it is possible at all to enforce mTLS within the operator? Perhaps using HA Proxy instead of ProxySQL? Would like to know what the options are, if any. ---
**Author:** ![vis21](https://avatars.discourse-cdn.com/v4/letter/v/e0b2c6/32.png) [@vis21](https://forums.percona.com/u/vis21)\ **Post date:** [October 15, 2025, 6:35am UTC](https://forums.percona.com/t/enforcing-mtls-with-proxysql/39536/2 "2025-10-15T06:35:46Z")
Additionally to the above, it seems that the operator doesn’t allow to set use\_ssl on users created by the operator (i.e. root, proxyadmin etc.). The moment that’s set, it gets reverted almost immediately, which isn’t the case when it’s set for users created outside the operator. This is unfortunate as at the very least it’d enforce standard TLS for users created by the operator connecting to ProxySQL, which is an option ProxySQL supports. I’ll raise this issue in GitHub.