Is SSL certificate necessary for MariaDB (or MySQL) to ensure the security

For me the solution is very simple:

I learned that an unencrypted connection with PHP (MariaDB and MySQL) and the localhost as host will connect via the UNIX socket and is therefore safe!
However, it is not a mistake to use an SSL certificate. This is particularly important for connections via applications in other programming languages ​​(e.g. Java).
Even if there is an internal danger in the network, it is advisable to choose an encrypted connection. (TLS is even safer then SSLv3).

In my case I don't need to use SSL or TLS.

Normally a database server should accept connects only from one application server configured by IP. If the database is used by more then one application, the server, which is able to connect to the database must hold a webservice which can be used to access the database.

There is no need to connect from different servers to a database. So you do not need any secure connection which would slow down the transfer.

Yes, if you have concerns about malicious users having access to your network, you should use SSL for connections between the app and the database server.

At my company, everything must be SSL. Every app-to-app connection must be https. Every database connection must be SSL. It doesn't matter that it's behind multiple levels of firewall in our internal network. It's defense in depth.

We do use certificates with the SSL, for both validating the SSL encryption and for authentication. It's stronger authentication than using passwords.

When we say SSL that's because the MySQL options use that term. But we really use TLS.

Note that MySQL's bind-address while limiting the clients who can connect to the database server, does not stop wiretappers from intercepting TCP packets. They don't have to connect to the database server to do that, they just have to be on the same network.

SSL (latest version was SSLv3) is considered to be vulnerable and isn't supported anymore by recent versions of MariaDB (and MySQL).

Instead of use the successor TLS (Transport Layer Security), preferrable protocol versions TLSv1.2 or TLSv1.3 which are considered to be safe. In Addition MariaDB also offers additional security checks for TLS connections, e.g.

Client:

• check the the name in server certificate matches the host name in connection string
• verify the finger print of server certificate
• specify a cipher suite for connection (or exclude certain cipher suites)

Server:

• require X509 certificate from client
• check subject and/or issuer of client certificate.
• specify a cipher suite for connection (or exclude certain cipher suites)

For more information please check

• Securing connections for client and server.
• Transport Layer Security