Prefer TLS by default when `ssl_mode` is omitted

[Yuhi-Sato]

Summary

I'd like to propose changing Trilogy's default ssl_mode to PREFERRED_NOVERIFY when ssl_mode is not explicitly configured.

This would align Trilogy's default behavior with MySQL client programs and reduce surprises when migrating from mysql2.

Motivation

Currently, Trilogy establishes an unencrypted connection by default, even when the server supports TLS.

In contrast, MySQL client programs (libmysqlclient) default to SSL_MODE_PREFERRED, attempting a TLS connection first and falling back to an unencrypted connection only if TLS is unavailable.

As a result, applications migrating from mysql2 to Trilogy may unexpectedly switch from encrypted connections to unencrypted connections without changing their configuration.

This difference is becoming more noticeable as managed MySQL services (for example, Aurora MySQL 8.4 by default) increasingly expect clients to use TLS.

Proposed behavior

When ssl_mode is omitted:

• Attempt a TLS connection.
• Fall back to an unencrypted connection if TLS is unavailable.
• Continue respecting any explicitly configured ssl_mode.

I'd be happy to prepare a PR with tests and documentation if this proposal sounds reasonable.

References

• MySQL 8.4 Reference Manual – Using Encrypted Connections
  https://dev.mysql.com/doc/refman/8.4/en/using-encrypted-connections.html

• MySQL 8.4 Reference Manual – --ssl-mode (SSL_MODE_PREFERRED is the default)
  https://dev.mysql.com/doc/refman/8.4/en/connection-options.html#option_general_ssl-mode

• Amazon Aurora MySQL – Security (require_secure_transport=ON by default in Aurora MySQL 8.4)
  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Security.html

[byroot]

Makes sense to me.