Unable to connect to Azure Database from an Azure pipeline

I've setup and Azure Database for MySQL. I am able to connect fine through the Azure Cloud Shell using

mysql -h ...mysql.database.azure.com --ssl -u web -p

Now what I want to do is to be able to connect to this database from an Azure pipeline. The purpose is to use the database to track the version numbers for our artifacts.

My initial test pipeline yaml looks like

trigger:
- main

pool:
  vmImage: ubuntu-latest

steps:
- checkout: none
- bash: |
    mysql -h ...mysql.database.azure.com -u web -p -D applications -N -e "select version, snapshot from releases where name='$1'" | while IFS= read -r value
    do
    echo $value
    done

However, the bash script never completes. The indicator simply spins and I have yet to receive a timeout or any type of error.

Since the database is setup to use SSL, my next iteration of the pipeline looked like

trigger:
- main

pool:
  vmImage: ubuntu-latest

steps:
- checkout: none
- bash: |
    mysql -h ...mysql.database.azure.com --ssl -u web -p -D applications -N -e "select version, snapshot from releases where name='$1'" | while IFS= read -r value
    do
    echo $value
    done

which mirrors the same connection I use in Cloud Shell. However this time I receive the following output

Starting: Bash
==============================================================================
Task         : Bash
Description  : Run a Bash script on macOS, Linux, or Windows
Version      : 3.182.0
Author       : Microsoft Corporation
Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/bash
==============================================================================
Generating script.
========================== Starting Command Output ===========================
/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/b5b259c5-bee8-4e95-b1c6-50a98baaf7dc.sh
mysql: [ERROR] unknown option '--ssl'.
Finishing: Bash

Finally I tried downloading the recommended certificate and adding it to the connection

trigger:
- main

pool:
  vmImage: ubuntu-latest

steps:
- checkout: none
- task: DownloadSecureFile@1
  inputs:
      secureFile: DigiCertGlobalRootG2.crt.pem
- bash: |
    mysql -h ...mysql.database.azure.com --ssl_cert $(Agent.TempDirectory)/DigiCertGlobalRootG2.crt.pem -u web -p -D applications -N -e "select version, snapshot from releases where name='$1'" | while IFS= read -r value
    do
    echo $value
    done

which again resulted in the task simply sitting there with no output. I'm not sure if this is a firewall issue(meaning I need to add a rule to the database firewall settings)? If this is the case, then how would I determine what range of IP addresses to allow?

By the way, I already have the following rule set

  {
    "endIpAddress": "55.226.19.255",
    "id": "/subscriptions/1fa96361-56c7-4090-8823-26ae03e4c38d/resourceGroups/VS-americas-manufacturing-Group/providers/Microsoft.DBforMySQL/servers/mfg-mysql-eus-1/firewallRules/cloudshell",
    "name": "cloudshell",
    "resourceGroup": "VS-americas-manufacturing-Group",
    "startIpAddress": "52.226.19.0",
    "type": "Microsoft.DBforMySQL/servers/firewallRules"
  }

but this doesn't seem to work for the pipelines.

So what setting changes do I need to make, either on the server or in my pipeline, to get this to work?