https://dev.mysql.com/doc/refman/5.7/en/encrypted-connection-protocols-ciphers.html seems to say you can force a particluar version via the
tls_version, with values such as TLSv1,TLSv1.1,TLSv1.2. (This is unlike the suggestion you envisioned.)
If that is not sufficient, here are more references:
----- 2016-07-07 Perc 5.6.31-77.0 -- New Features -- -----
Percona Server has implemented protocol support for TLS 1.1 and TLS 1.2. This implementation turns off TLS v1.0 support by default.
----- 2016-07-29 5.7.14 General Availability -- X Plugin Notes -- -----
When using SSL, only TLSv1 connections were being accepted. The fix ensures that all TLS versions supported by the server are accepted. (Bug #23524243)
----- 2016-07-29 5.7.14 General Availability -- Bugs Fixed -- Replication -----
Slaves running MySQL version 5.7.11 and later were always using SSL/TLS when the server supported it, regardless of the MASTER_SSL option. This was due to the addition of the --ssl-mode option, which defaults to preferring an SSL connection. The fix ensures that slaves do not use SSL when MASTER_SSL=0. (Bug #81223, Bug #23197529)
----- 2016-06-02 5.7.13 General Availability -- Bugs Fixed -- -----
The mysql_read_defaults_options() function was missing a break statement, causing any option value for the --ssl-cipher option also to be applied to the --tls-version option, with unpredictable results. (Bug #81139, Bug #23129821)
----- 2015-12-07 5.7.10 General Availability -- Security Notes -- -----
Previously, MySQL supported only the TLSv1 protocol for encrypting secure connections. TLS support is now extended to enable a higher level of encrypted connection security:
When compiled using OpenSSL 1.0.1 or higher, MySQL supports the TLSv1, TLSv1.1, and TLSv1.2 protocols.
When compiled using the bundled version of yaSSL, MySQL supports the TLSv1 and TLSv1.1 protocols.
Because TLSv1.2 requires OpenSSL, support for this protocol is available in binary distributions only for MySQL Commercial Server, and not for MySQL Community Server (which is compiled using yaSSL). To enable TLSv1.2 support if you build from source, you must set the WITH_SSL CMake option to use OpenSSL.
The tls_version system variable enables specifying at startup the TLS protocols permitted by the server. On the client side, the --tls-version option enables specifying the TLS protocols permitted per client invocation.
The new MASTER_TLS_VERSION option for the CHANGE MASTER TO statement specifies the encryption protocols permitted by the master for slave connections.
The mysql_options() C API function has a new MYSQL_OPT_TLS_VERSION option that enables specifying from within the client library the TLS protocols permitted by a client program.
By default, MySQL attempts to use the highest TLS protocol version available, depending on which SSL library was used to compile the server and client, which key size is used, and whether the server or client are restricted from using some protocols; for example, by means of tls_version/--tls-version.
For more information, see Secure Connection Protocols and Ciphers.
It appears that MariaDB 10.2 has picked up the TLS code, though I can't tell if it is up to date with the above. Previously:
----- 2014-12-21 MariaDB 5.5.41 & 2014-11-25 MariaDB 10.0.15 -- -- -----
MDEV-6975 Implement TLS protocol
----- 2014-11-25 MariaDB 10.0.15 -- -- -----
MDEV-6975 Implement TLS protocol Revision #4500.1.22 [merge] Thu 2014-11-20 16:07:34 +0100 5.5 merge