The only reason I can think of is to not break existing applications that use

CREATE USER ... REQUIRE { SSL | X509 | CIPHER 'cipher' | ISSUER 'issuer' | SUBJECT 'subject'

And because TLS is established before the user name is known, the server cannot force TLS only for those users that REQUIRE it.

On the other hand, the server can ignore REQUIRE SSL and REQUIRE X509 over a secure connection, just pretend it's satisfied. May be REQUIRE CIPHER too (this is questionable).

And REQUIRE ISSUER and REQUIRE SUBJECT check the client side certificate. So the client only needs to establish TLS if it has a certificate or a connection is potentially MitM-able.

I've done some more tests and it seems my assumption, that TLS over UNIX socket is a new thing in 11.4, was wrong. Even earlier MariaDB versions are using TLS over UNIX socket, when `ssl_key`, `ssl_cert` and `ssl_ca` configuration is used, with an exception that server certificate is not verified by default.

This indeed makes it possible that there are existing applications, which were successfully using `REQUIRE SSL` while connecting through UNIX socket and disabling TLS altogether (like my PR) would break them.

In that sense, I understand, that not checking TLS hostname for non-MitM-able connections is probably the easiest and safest fix.

I'm not sure about making UNIX socket satisfy `REQUIRE SSL`. For me it would be enough to have a way to disable TLS over UNIX socket by default (without extra command-line options) and keep living my simple life with local connections and no `REQUIRE SSL`-s. I still like the idea of having TLS over TCP/IP by default, so I don't want to disable that.

Since the current implementation of Connector/C 3.4 accepts self signed certificates for local connections which are considered secure (unix socket, 127.0.0.1, ::1) we should disable hostname verification for these connections too.

Other checks such as revocation or time period validity checks should still be performed for secure connections

Folks, I don't want to disappoint you, but it seems there's still issue left, now I can see it only in mariabackup only in 11.4.4. I've created a separate bug report for it: MDEV-35368