# Data Encryption in Transit - TLS
+ `TLS` is mandatory for connecting to TiDB clusters managed by TiDB Cloud
  + TiDB Dedicated: The cluster `CA` (Certificate Authority) certificate must be specified when connecting
  + TiDB Serverless: The default `CA` certificates bundle can be specified when connecting
+ TLS version `1.2/1.3` are supported
![`smart`](TiDBCloudDedicatedTLSCA_aa_001_20230924.png)
```
~!@# Example:@!~

mysql \
  --comments --connect-timeout 15 ~!@--ssl-mode=VERIFY_IDENTITY@!~ \
  ~!@--ssl-ca=<path-to-ca-file> --tls-version="TLSv1.2"@!~ \
  -u root -h tidb.xxxxxxx.clusters.tidb-cloud.com -P 4000 -D test -p<your_password>

mysql> SHOW STATUS WHERE VARIABLE_NAME='Ssl_cipher';
+---------------+----------------------+
| Variable_name | Value                |
+---------------+----------------------+
| Ssl_cipher    | ECDHE-RSA-AES128-SHA |
+---------------+----------------------+
1 row in set (0.18 sec)
```

------------------------------------------------------------------------------
Establishing a secure TLS connection between your client and your TiDB cluster is considered to be one of the fundamental security measures when connecting to your databases. You cannot connect to the TiDB cluster in the TiDB cloud using plaintext. Only TLS is supported as the connection method.

The server certificate for TiDB Serverless is issued by an independent third-party certificate provider. You can easily connect to your TiDB Serverless cluster without downloading a server-side digital certificate. The default CA bundle file provided by your operating system is adequate to support a secure connection between the client and the TiDB serverless. The CA certificate locations by operating systems are:
- `macOS/Alpine: /etc/ssl/cert.pem`
- `Debian/Ubuntu/Arch: /etc/ssl/certs/ca-certificates.crt`
- `CentOS/RedHat/Fedora: /etc/pki/tls/certs/ca-bundle.crt`
- `OpenSUSE: /etc/ssl/ca-bundle.pem`
- `Windows:` Windows does not offer a specific path to the CA root. Instead, it uses the registry to store certificates. For this reason, you must first download the CA bundle file:
  - Download the Mozilla CA Certificate bundle from `https://curl.se/docs/caextract.html` and save it

TiDB Cloud supports client-server and cluster component-component TLS transmission encryption based on X.509 certificates. This ensures that data is encrypted during transmission, which improves data security.

Server-Client: Supports enabling TLS between the client and TiDB server. This ensures the security of data transmitted between the client and server.

Component-Component: Supports enabling TLS between internal components of TiDB Cluster. This ensures the security of data transmission between internal components of TiDB Cluster.