Is it impossible to force MariaDB users to SSL?
REQUIRE SSL grant option on users is what you need. It works for me as intended:

MariaDB [(none)]&gt; CREATE USER testssl@localhost;
Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]&gt; GRANT USAGE ON *.* TO testssl@localhost REQUIRE SSL;
Query OK, 0 rows affected (0.001 sec)

MariaDB [(none)]&gt; Bye

$ sudo mysql -u testssl --ssl
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 11
Server version: 10.3.7-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]&gt; show grants;
+---------------------------------------------------------+
| Grants for testssl@localhost                            |
+---------------------------------------------------------+
| GRANT USAGE ON *.* TO 'testssl'@'localhost' REQUIRE SSL |
+---------------------------------------------------------+
1 row in set (0.000 sec)

MariaDB [(none)]&gt; Bye

$ sudo mysql -u testssl --skip-ssl
ERROR 1045 (28000): Access denied for user 'testssl'@'localhost' (using password: NO)

$ grep ssl /etc/my.cnf
ssl-ca = /etc/mysql/ca.pem # [client]
ssl-cert = /etc/mysql/client-cert.pem
ssl-key = /etc/mysql/client-key.pem
ssl-ca = /etc/mysql/ca.pem # [server]
ssl-cert = /etc/mysql/server-cert.pem
ssl-key = /etc/mysql/server-key.pem


You can see how workbench works with SSL, but fails to connect if I force it to not use SSL:




require_secure_transport is MySQL 5.7+ only, and while it has something to do with forcing TLS, it also considers secure local unencrypted connections.