Summary

MysqlConnection._parseMysqlUri maps ssl-mode=prefer (and false/disable) to secure: false. prefer is a common URI default and must not turn TLS off. require / verify_ca / verify_identity only set secure: true; the driver encrypts without verifying unless sslrootcert builds a SecurityContext.

Form default useSSL = true is encrypt-only (secure:), same class as Postgres #790.

Scope

• Treat prefer as TLS on (or try TLS then fall back — if fallback, say so in the UI). Do not map it to disable.
• When verify_ca / verify_identity (or form equivalent) is set, require a CA and fail closed without it.
• Tests in mysql_connection_test for prefer, require, verify_identity.

Out of scope

• Rewriting the vendored mysql_client handshake beyond securityContext.