> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure TLS Version Is Set To TLSV1.2 For MySQL Flexible Database Server

### More Info:

Ensure TLS version on MySQL flexible servers is set to the default value.

### Risk Level

Medium

### Address

Security

### Compliance Standards

CISAZURE, CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure TLS Version Is Set To TLSV1.2 For MySQL Flexible Database Server" for Azure using Azure console, please follow the below steps:

        1. Login to Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to "Azure Database for MySQL Flexible Server" service.
        3. Select the "Flexible server" for which you want to remediate the misconfiguration.
        4. Under the "Settings" section, click on "Connection security".
        5. Under the "Connection security" tab, select "TLS 1.2" from the "TLS version" drop-down list.
        6. Click on the "Save" button to save the changes.

        Once you have completed these steps, your Azure MySQL Flexible Server will be configured to use TLS version 1.2 for connection security.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure TLS Version Is Set To TLSV1.2 For MySQL Flexible Database Server" for AZURE using AZURE CLI, you can follow the below steps:

        Step 1: Open the AZURE CLI and login to your account using the following command:

        ```
        az login
        ```

        Step 2: Once you are logged in, set the subscription where your MySQL Flexible Database Server is located using the following command:

        ```
        az account set --subscription <subscription_id>
        ```

        Step 3: Next, retrieve the resource ID of your MySQL Flexible Database Server using the following command:

        ```
        az mysql flexible-server list --query "[?name=='<server_name>'].id" -o tsv
        ```

        Replace `<server_name>` with the name of your MySQL Flexible Database Server.

        Step 4: Now, update the TLS version to TLSv1.2 for your MySQL Flexible Database Server using the following command:

        ```
        az mysql flexible-server update --name <server_name> --resource-group <resource_group_name> --tls-version "TLSv1.2"
        ```

        Replace `<server_name>` with the name of your MySQL Flexible Database Server and `<resource_group_name>` with the name of the resource group where your MySQL Flexible Database Server is located.

        Step 5: Verify that the TLS version has been updated to TLSv1.2 for your MySQL Flexible Database Server using the following command:

        ```
        az mysql flexible-server show --name <server_name> --resource-group <resource_group_name> --query "tlsVersion"
        ```

        Replace `<server_name>` with the name of your MySQL Flexible Database Server and `<resource_group_name>` with the name of the resource group where your MySQL Flexible Database Server is located.

        Once you have completed these steps, the misconfiguration "Ensure TLS Version Is Set To TLSV1.2 For MySQL Flexible Database Server" will be remediated for your AZURE MySQL Flexible Database Server.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure TLS Version Is Set To TLSV1.2 For MySQL Flexible Database Server" in AZURE using Python, you can use the Azure SDK for Python. Here are the steps to remediate the misconfiguration:

        1. Import the required libraries:

        ```python theme={null}
        from azure.identity import DefaultAzureCredential
        from azure.mgmt.rdbms import MySQLManagementClient
        from azure.mgmt.rdbms.models import ServerUpdateParameters
        ```

        2. Set the Azure credentials:

        ```python theme={null}
        credential = DefaultAzureCredential()
        subscription_id = 'your_subscription_id'
        resource_group_name = 'your_resource_group_name'
        server_name = 'your_server_name'
        ```

        3. Instantiate the MySQLManagementClient:

        ```python theme={null}
        client = MySQLManagementClient(credential, subscription_id)
        ```

        4. Get the current server configuration:

        ```python theme={null}
        server = client.servers.get(resource_group_name, server_name)
        ```

        5. Update the server configuration to set TLS version to TLSv1.2:

        ```python theme={null}
        server_update_params = ServerUpdateParameters(tls_version="TLSv1.2")
        client.servers.update(resource_group_name, server_name, server_update_params)
        ```

        6. Verify the updated configuration:

        ```python theme={null}
        server = client.servers.get(resource_group_name, server_name)
        print(server.tls_version)
        ```

        Note: Make sure to replace the placeholders "your\_subscription\_id", "your\_resource\_group\_name", and "your\_server\_name" with your actual values. Also, make sure to authenticate the Azure credentials before running the code.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.microsoft.com/en-us/azure/mysql/concepts-ssl-connection-security](https://docs.microsoft.com/en-us/azure/mysql/concepts-ssl-connection-security)