What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure MySQL TLS by giving the server a PEM-encoded CA certificate, server certificate, and private key; enabling those files in the active my.cnf; then making clients use VERIFY_CA or VERIFY_IDENTITY. Use require_secure_transport=ON when every remote TCP connection must be encrypted, or apply REQUIRE SSL/REQUIRE X509 to selected accounts during a staged rollout. Finally, verify the negotiated protocol and cipher from both the client and MySQL’s TLS status variables.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What MySQL TLS protects—and what it does not
SSL/TLS encrypts the connection between a MySQL client and server. It protects credentials, SQL statements, result sets, and other traffic from being read or modified while crossing a network. The server certificate also lets a client establish that it is talking to the intended server, provided the client validates the certificate chain and hostname.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsTLS is separate from MySQL account authentication. A user can still authenticate with a password over an encrypted connection, or an account can require a client certificate as an additional identity factor. Encryption is also separate from authorization: TLS does not grant database privileges.
The procedure below applies to MySQL on a Linux server. File locations and service names vary by distribution, so use the configuration file and service unit that actually control your installation. The examples use /etc/mysql/tls and a service account named mysql.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the security policy before changing files
| Decision | Option | What it does | When to use it |
|---|---|---|---|
| Transport scope | require_secure_transport=ON |
Rejects nonsecure TCP connection attempts globally. Unix-socket connections remain permitted under MySQL’s documented behavior. | Use when all network clients must be encrypted and you have tested every client. |
| Transport scope | ALTER USER ... REQUIRE SSL |
Requires an encrypted connection for one account and host pattern. | Use for a staged rollout or for accounts with different policies. |
| Authentication model | REQUIRE X509 |
Requires the client to present a certificate and private key in addition to establishing TLS. | Use for mutual X.509 authentication when you operate a client-certificate lifecycle. |
| Client assurance | --ssl-mode=REQUIRED |
Requires encryption but does not validate that the certificate chains to a particular CA or that its name matches the host. | Use as a minimum anti-downgrade setting when certificate validation is handled elsewhere. |
| Client assurance | --ssl-mode=VERIFY_CA |
Requires TLS and validates the server certificate chain against the supplied CA. | Use when you need server authentication and the connection uses a stable CA trust anchor. |
| Client assurance | --ssl-mode=VERIFY_IDENTITY |
Validates the CA chain and checks that the hostname used by the client matches the certificate identity. | Prefer this for production connections when DNS names and certificate SANs are managed correctly. |
The strongest practical default for ordinary applications is global secure transport combined with client-side VERIFY_IDENTITY. Introduce it in stages if you cannot confirm that all clients trust the CA and use names present in the server certificate.
Prepare a CA, server certificate, and private key
MySQL expects PEM-encoded files. You need three server-side objects:
- CA certificate: the trust anchor that clients use to validate the server certificate.
- Server certificate: a public certificate signed by that CA. Its Subject Alternative Name (SAN) must contain every DNS name—or IP address, where applicable—that clients use with
VERIFY_IDENTITY. - Server private key: the secret key corresponding to the server certificate.
You can use MySQL’s certificate-generation assistance or create certificates directly with openssl. Explicitly managed certificates are preferable for controlled deployments because you can define names, validity periods, renewal procedures, and access controls yourself. MySQL builds linked with OpenSSL can generate missing certificate and key files at startup, but relying on automatic generation makes the certificate lifecycle less predictable.
Example: create a small private CA and server certificate with OpenSSL
The following is a compact example for a server whose clients connect as db.example.com. Replace names and paths with values appropriate for your environment. Keep the CA private key offline or otherwise protected; it is more sensitive than the CA certificate distributed to clients.
sudo install -d -m 0750 -o mysql -g mysql /etc/mysql/tls
cd /etc/mysql/tls
# Create a CA private key and self-signed CA certificate
sudo openssl genrsa -out ca-key.pem 4096
sudo openssl req -x509 -new -nodes -key ca-key.pem
-sha256 -days 3650 -out ca.pem
-subj "/CN=Example MySQL CA"
# Create the server private key and certificate-signing request
sudo openssl genrsa -out server-key.pem 2048
sudo openssl req -new -key server-key.pem -out server.csr
-subj "/CN=db.example.com"
# Include every name clients will use in the certificate identity
cat > server-ext.cnf <<'EOF'
basicConstraints=CA:FALSE
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth
subjectAltName=DNS:db.example.com,DNS:db
EOF
# Sign the server certificate with the CA
sudo openssl x509 -req -in server.csr -CA ca.pem -CAkey ca-key.pem
-CAcreateserial -out server-cert.pem -days 825 -sha256
-extfile server-ext.cnf
# Lock down the private key and let the MySQL service read the TLS files
sudo chown mysql:mysql server-key.pem server-cert.pem ca.pem
sudo chmod 600 server-key.pem
sudo chmod 644 server-cert.pem ca.pemFor a public or organization-wide PKI, obtain the server certificate through that PKI instead of creating a local CA. Do not copy the CA private key to application hosts. Distribute only ca.pem to clients that must verify the server.
Before configuring MySQL, check that the certificate and key match and that the certificate contains the names clients will use:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →openssl x509 -in /etc/mysql/tls/server-cert.pem -noout -subject -issuer -dates -ext subjectAltName
openssl x509 -noout -modulus -in /etc/mysql/tls/server-cert.pem | openssl sha256
openssl rsa -noout -modulus -in /etc/mysql/tls/server-key.pem | openssl sha256The two modulus hashes should be identical for an RSA key. For an ECDSA key, use the corresponding public-key comparison method supported by your OpenSSL version.
Configure the MySQL server
Put the TLS settings in the active MySQL configuration file under the [mysqld] group. Do not assume that a similarly named file is loaded; distributions commonly include several configuration directories. Use the file your service actually reads.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
[mysqld]
ssl_ca=/etc/mysql/tls/ca.pem
ssl_cert=/etc/mysql/tls/server-cert.pem
ssl_key=/etc/mysql/tls/server-key.pemssl_ca identifies the CA certificate used by the server TLS context, ssl_cert identifies the server’s public certificate, and ssl_key identifies its private key. The MySQL service account must be able to read the files, while other users should not be able to read the private key.
For a global policy, add:
[mysqld]
require_secure_transport=ONWith this setting enabled, an insecure TCP attempt is rejected. A local Unix-socket connection is treated as secure transport under MySQL’s documented rule, so this setting does not automatically block local socket access. If local applications must also use TCP TLS, configure them to connect to a host name or loopback TCP address and test that path separately.
Enforce TLS globally or account by account
Global enforcement
require_secure_transport=ON is the clearest policy when every network connection must be protected. Inventory backup jobs, monitoring, migration tools, replication-related clients, connection pools, and administrative scripts first. A forgotten client can lose access as soon as the server starts enforcing the setting.
Per-account enforcement
For a staged rollout, require encryption for selected accounts:
ALTER USER 'app'@'app-host.example.com' REQUIRE SSL;The host part is part of the account identity. Apply the requirement to every matching account row that the application can use; changing a similarly named account with a different host pattern does not change the application’s actual account.
Mutual certificate authentication
Use REQUIRE X509 when the account must present a client certificate and private key:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →ALTER USER 'app'@'app-host.example.com' REQUIRE X509;This is stricter than REQUIRE SSL. The client must establish TLS and send a certificate that satisfies the account’s X.509 requirement. Plan issuance, renewal, revocation, storage, and rotation of client keys before enabling this policy.
Restart or reload the TLS context safely
After changing certificate files or my.cnf, restart the MySQL service using the unit name on your distribution, for example:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo systemctl restart mysqlWhere supported by your MySQL version, you can reload certificates without a full restart:
ALTER INSTANCE RELOAD TLS;Validate replacement files before reloading. If validation fails, MySQL does not activate the replacement files; the prior active TLS context remains in place. Treat a successful SQL command and a successful client connection as separate checks, because a reload can preserve the old context while an operator investigates the new files.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWatch the service log immediately after a restart or reload. Typical causes of failure are a misspelled path, a private key unreadable by the MySQL account, a certificate-key mismatch, an expired certificate, or a certificate that is not PEM encoded.
Configure MySQL clients without plaintext fallback
Require encryption only
mysql -h db.example.com -u app -p --ssl-mode=REQUIREDREQUIRED makes the connection attempt fail if a secure connection cannot be established; it does not permit a silent downgrade to plaintext. It is better than allowing a client’s default behavior to choose an unencrypted connection, but it does not provide the strongest server identity checks.
Validate the issuing CA
mysql -h db.example.com -u app -p
--ssl-mode=VERIFY_CA
--ssl-ca=/etc/mysql/tls/ca.pemVERIFY_CA validates that the server certificate chains to the CA supplied with --ssl-ca. Copy the CA certificate, not the CA private key, to the client host. Every verifying client needs a current copy of the trust anchor.
Validate the CA and hostname
mysql -h db.example.com -u app -p
--ssl-mode=VERIFY_IDENTITY
--ssl-ca=/etc/mysql/tls/ca.pemVERIFY_IDENTITY performs CA validation and checks the server name against the certificate identity. The name passed to -h must match a SAN in the certificate. If clients connect through an alias, internal name, or IP address, include that identity in the certificate or use a name that is already present. Do not “fix” a hostname mismatch by falling back to REQUIRED; issue a certificate with the correct identity instead.
Supply a client certificate for REQUIRE X509
mysql -h db.example.com -u app -p
--ssl-mode=VERIFY_IDENTITY
--ssl-ca=/etc/mysql/tls/ca.pem
--ssl-cert=/etc/mysql/tls/app-cert.pem
--ssl-key=/etc/mysql/tls/app-key.pemProtect app-key.pem as carefully as the server private key. The client certificate must be issued by a CA trusted for the server’s client-certificate policy, and the account must be configured with REQUIRE X509.
Use a CA directory when many CAs are involved
Instead of a single CA file, MySQL can use a CA directory through ssl_capath. On Linux, create the required OpenSSL hash links before starting or reloading MySQL:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
openssl rehash /path/to/ca-directoryWithout the rehashed links, OpenSSL may not find certificates in the directory even though the files are present. Keep only the CA certificates that should be trusted for this server and maintain the directory as part of certificate rotation.
Set TLS versions and ciphers deliberately
MySQL 8.4 can use TLS 1.3 when the server was compiled against OpenSSL 1.1.1 or newer. You can constrain protocol versions with tls_version and TLS 1.3 cipher suites with tls_ciphersuites, but do so only after checking every client and connector in the deployment.
Free tools Windows power users keep installed
One-click scans. No signup required.
[mysqld]
tls_version=TLSv1.2,TLSv1.3
# Set tls_ciphersuites only with values supported by your OpenSSL build and clients.Removing an older protocol can break legacy drivers, operating-system libraries, health checks, or backup utilities. A protocol policy is successful only when all required clients can negotiate one of the enabled versions. Change one constraint at a time and test connection pools as well as one-off command-line connections.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify that encryption and certificate validation are really working
Inspect the client connection
Connect with an enforced mode, then run the client status command:
mysql -h db.example.com -u app -p
--ssl-mode=VERIFY_IDENTITY --ssl-ca=/etc/mysql/tls/ca.pem
mysql> sThe status output should show an SSL/TLS session and identify the negotiated cipher. If the output does not show an encrypted session, stop and investigate rather than assuming the server policy was applied.
You can also inspect session status values from SQL:
SHOW SESSION STATUS LIKE 'Ssl_cipher';
SHOW SESSION STATUS LIKE 'Ssl_version';A nonempty cipher and a TLS protocol value indicate that the current session is encrypted. These checks describe the connection you are using; run them from the same application path and host that matters operationally.
Inspect MySQL’s active TLS context
MySQL exposes the active CA, certificate, key, cipher, and protocol configuration through TLS-related status variables. List them on the server:
SHOW STATUS LIKE 'Current_tls%';Review the returned paths and values against the files you intended to load. This catches cases where an edit was made to an unused configuration file or a reload retained the previous valid context.
Test rejection, not just success
- Attempt a connection with a client mode that does not provide TLS and confirm that a globally enforced server rejects it over TCP.
- Use an incorrect or missing CA file with
VERIFY_CAand confirm that certificate validation fails. - Connect with a hostname absent from the certificate using
VERIFY_IDENTITYand confirm that identity validation fails. - For an account using
REQUIRE X509, omit--ssl-certand--ssl-keyand confirm that the account cannot connect.
Perform negative tests from a safe test account or maintenance window. Do not use a production application account as an experiment.
Deployment choices compared
| Deployment choice | Scope | Verification strength | Authentication | Certificate lifecycle | Main trade-off |
|---|---|---|---|---|---|
Server TLS, client REQUIRED |
Per client; optionally global server enforcement | Encryption without CA/name validation | Normal MySQL credentials | Managed CA and server files | Prevents plaintext fallback but gives weaker protection against an impersonating server. |
Server TLS, client VERIFY_CA |
Per client; optionally global server enforcement | Certificate chain validated | Normal MySQL credentials | CA distribution plus server renewal | Requires every client to have the right CA; does not check the hostname. |
Server TLS, client VERIFY_IDENTITY |
Per client; optionally global server enforcement | Chain and hostname validated | Normal MySQL credentials | CA distribution and accurate SAN management | Aliases and IP-based connections fail unless their identities are certified. |
Account REQUIRE SSL |
Selected account and host entry | Encryption required for that account | Password or other normal MySQL authentication | Server certificate lifecycle | Useful for rollout, but every relevant account row must be covered. |
Account REQUIRE X509 |
Selected account and host entry | TLS plus client certificate | Mutual X.509 authentication | Server and per-client certificate issuance, renewal, and revocation | Strong identity binding with substantially more operational overhead. |
| MySQL-assisted certificate generation | Server TLS context | Depends on client verification mode | Normal or X.509 account policy | Convenient generation; less explicit lifecycle control | Useful for simple setups, but controlled deployments generally prefer managed files. |
| Externally managed certificates | Server TLS context | Depends on client verification mode | Normal or X.509 account policy | Explicit renewal and distribution process | More administration, but clearer ownership and predictable rotation. |
Troubleshoot the common failure modes
“SSL connection error” immediately after enabling enforcement
First determine whether the client is connecting over TCP or a Unix socket. A local socket may still be permitted by require_secure_transport=ON, while a remote TCP client must negotiate TLS. For TCP clients, add --ssl-mode=REQUIRED at minimum and then move to certificate verification.
“Unable to get local issuer certificate”
The client cannot build a chain from the server certificate to the CA it trusts. Confirm that --ssl-ca points to the issuing CA (or a bundle containing it), that the server certificate was signed by that CA, and that the client received the current CA after a CA rotation.
Hostname verification fails
Check the SAN values in the server certificate and compare them with the exact value passed to -h. A certificate for db.example.com does not automatically authenticate db.internal or an IP address. Add the required SANs in a replacement certificate and reload it, or change clients to a certified name.
MySQL cannot read the key
Verify ownership, mode bits, parent-directory traversal permissions, and any mandatory access-control policy applied by the Linux distribution. The MySQL service account needs read access to the private key and certificate files; ordinary users should not have it. A syntactically correct path is insufficient if the service cannot traverse /etc/mysql/tls.
Recommended Free Tools
Reload appears successful but the old certificate is still active
Query SHOW STATUS LIKE 'Current_tls%'; and inspect the service log. MySQL keeps the previous active context when replacement-file validation fails. Correct the replacement files, then run ALTER INSTANCE RELOAD TLS again or restart the service.
Older clients stop connecting after a protocol change
Compare the client driver and its underlying TLS library with the versions allowed by tls_version and tls_ciphersuites. Restore a mutually supported protocol temporarily, upgrade the incompatible clients, and only then tighten the server policy again.
An X.509 account rejects a client that otherwise has TLS
REQUIRE X509 needs a client certificate and private key. Add --ssl-cert and --ssl-key, verify that the key matches the certificate, and ensure the certificate chains to the CA accepted for client authentication. A server-only TLS connection is not enough for this account requirement.
A CA directory is ignored
Run openssl rehash on the directory after adding or replacing CA files, then reload the TLS context. Check that ssl_capath points to the directory itself and that the MySQL process can read it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
Operational checklist for production
- Record every DNS name and IP address that clients use, and include required names in the certificate SAN.
- Store the server private key with restrictive permissions and limit access to the MySQL service account and designated administrators.
- Distribute the CA certificate to every client that uses
VERIFY_CAorVERIFY_IDENTITY; never distribute the CA private key. - Test one application connection with
VERIFY_IDENTITYbefore enabling global enforcement. - Inventory local socket users because global secure transport does not block Unix-socket connections under the documented rule.
- Test backups, monitoring, migrations, connection pools, and command-line tools, not just one interactive session.
- Keep a renewal procedure that replaces the certificate before expiry and verifies the new SANs, chain, key, permissions, and active status.
- Use
SHOW SESSION STATUSandSHOW STATUS LIKE 'Current_tls%'as post-change checks. - When changing protocol or cipher policy, confirm compatibility with every required client before removing an older option.
- Keep a recovery path: a tested maintenance connection, known-good prior certificate files, and a way to restore the previous configuration if validation or client compatibility fails.
A practical rollout sequence
- Create or obtain the CA certificate, server certificate, and server private key. Verify the certificate names and key match.
- Install the files in a protected directory readable by MySQL, then configure
ssl_ca,ssl_cert, andssl_keyin the active[mysqld]configuration. - Restart MySQL or use
ALTER INSTANCE RELOAD TLSwhere supported. Check the active TLS status variables. - Configure a test client with
--ssl-mode=VERIFY_IDENTITYand--ssl-ca. Confirm the status output shows a cipher and TLS version. - Apply
REQUIRE SSLto a test account, then test the application’s real connection path. - If mutual authentication is required, issue a client certificate, add
REQUIRE X509, and test with--ssl-certand--ssl-key. - After all clients pass, set
require_secure_transport=ONto enforce encrypted TCP connections globally. - Only after compatibility testing, constrain
tls_versionand, if necessary,tls_ciphersuites. - Document renewal dates, CA distribution, account requirements, and the verification commands so future rotations are repeatable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
