Index: configure.ac
===================================================================
--- configure.ac	(revision 90475)
+++ configure.ac	(working copy)
@@ -1290,6 +1290,14 @@
 
 AM_CONDITIONAL([ZBXCMOCKA], [(test -d tests/) && (test "x$server" = "xyes" || test "x$agent" = "xyes")])
 
+AC_ARG_ENABLE(dbtls,[  --enable-dbtls          Turn on support of secure DB connections],
+[case "${enableval}" in
+  yes) dbtls=yes ;;
+  no)  dbtls=no ;;
+  *) AC_MSG_ERROR([bad value ${enableval} for --enable-dbtls]) ;;
+esac],
+[dbtls=no])
+
 have_db="no"
 have_unixodbc="no"
 have_web_monitoring="no"
@@ -1306,6 +1314,11 @@
 	have_ipv6="yes"
 fi
 
+if test "x$dbtls" = "xyes"; then
+	AC_DEFINE(DBTLS,1,[Define to 1 if support for secure DB connections should be enabled.])
+	have_dbtls="yes"
+fi
+
 if test "x$server" = "xyes" || test "x$proxy" = "xyes"; then
 
 	have_multirow_insert="no"
@@ -1313,6 +1326,10 @@
 	dnl Checking for IBM DB2 support
 	AX_LIB_IBM_DB2()
 	if test "x$want_ibm_db2" = "xyes"; then
+		if test "x$have_dbtls" = "xyes"; then
+			AC_MSG_ERROR([Secure connections are not supported for IBM DB2])
+		fi
+
 		if test "x$have_db" != "xno"; then
 			AC_MSG_ERROR([You can configure for only one database.])
 		fi
@@ -1343,6 +1360,10 @@
 	dnl Checking for Oracle support
 	AX_LIB_ORACLE_OCI([10.0])
 	if test "x$want_oracle_oci" = "xyes"; then
+		if test "x$have_dbtls" = "xyes"; then
+			AC_MSG_ERROR([Secure connections are not supported for Oracle])
+		fi
+
 		if test "x$have_db" != "xno"; then
 			AC_MSG_ERROR([You can configure for only one database.])
 		fi
@@ -1363,6 +1384,10 @@
 	dnl Checking for PostgreSQL support
 	AX_LIB_POSTGRESQL("8.1")
 	if test "x$want_postgresql" = "xyes"; then
+		if test "x$have_dbtls" = "xyes"; then
+			AC_MSG_ERROR([Secure connections are not supported for PostgreSQL])
+		fi
+
 		if test "x$have_db" != "xno"; then
 			AC_MSG_ERROR([You can configure for only one database.])
 		fi
@@ -1390,6 +1415,11 @@
 			AC_MSG_ERROR([SQLite is not supported as a main Zabbix database backend.])
 		fi
 
+		if test "x$have_dbtls" = "xyes"; then
+			AC_MSG_ERROR([Secure connections are not supported for SQLite3])
+		fi
+
+
 		if test "x$have_db" != "xno"; then
 			AC_MSG_ERROR([You can configure for only one database.])
 		fi
@@ -2025,6 +2055,7 @@
 
 echo "  Server details:
     With database:         ${have_db}
+    Secure connections:    ${have_dbtls}
     WEB Monitoring:        ${have_web_monitoring}"
 
 if test "x$have_web_monitoring" = "xcURL"; then
@@ -2054,6 +2085,7 @@
 
 echo "  Proxy details:
     With database:         ${have_db}
+    Secure connections:    ${have_dbtls}
     WEB Monitoring:        ${have_web_monitoring}"
 
 if test "x$have_web_monitoring" = "xcURL"; then
Index: include/db.h
===================================================================
--- include/db.h	(revision 90475)
+++ include/db.h	(working copy)
@@ -32,6 +32,13 @@
 extern char	*CONFIG_DBPASSWORD;
 extern char	*CONFIG_DBSOCKET;
 extern int	CONFIG_DBPORT;
+#ifdef DBTLS
+extern char	*CONFIG_DB_KEY_FILE;
+extern char	*CONFIG_DB_CERT_FILE;
+extern char	*CONFIG_DB_CA_FILE;
+extern char	*CONFIG_DB_CA_PATH;
+extern char	*CONFIG_DB_CIPHER;
+#endif
 extern int	CONFIG_HISTSYNCER_FORKS;
 extern int	CONFIG_UNAVAILABLE_DELAY;
 
Index: include/zbxdb.h
===================================================================
--- include/zbxdb.h	(revision 90475)
+++ include/zbxdb.h	(working copy)
@@ -78,7 +78,11 @@
 int	zbx_db_init(const char *dbname, const char *const db_schema, char **error);
 void	zbx_db_deinit(void);
 
-int	zbx_db_connect(char *host, char *user, char *password, char *dbname, char *dbschema, char *dbsocket, int port);
+int	zbx_db_connect(char *host, char *user, char *password, char *dbname, char *dbschema, char *dbsocket, int port
+#ifdef DBTLS
+		, const char *key, const char *cert, const char *ca, const char *capath, const char *cipher
+#endif
+);
 void	zbx_db_close(void);
 
 int	zbx_db_begin(void);
Index: src/libs/zbxdb/db.c
===================================================================
--- src/libs/zbxdb/db.c	(revision 90475)
+++ src/libs/zbxdb/db.c	(working copy)
@@ -21,6 +21,10 @@
 
 #include "zbxdb.h"
 
+#if defined(DBTLS) && !defined(HAVE_MYSQL)
+#	error "Secure connection with database server is only available for MySQL."
+#endif
+
 #if defined(HAVE_IBM_DB2)
 #	include <sqlcli1.h>
 #elif defined(HAVE_MYSQL)
@@ -374,7 +378,11 @@
  *               ZBX_DB_FAIL - failed to connect                              *
  *                                                                            *
  ******************************************************************************/
-int	zbx_db_connect(char *host, char *user, char *password, char *dbname, char *dbschema, char *dbsocket, int port)
+int	zbx_db_connect(char *host, char *user, char *password, char *dbname, char *dbschema, char *dbsocket, int port
+#ifdef DBTLS
+		, const char *key, const char *cert, const char *ca, const char *capath, const char *cipher
+#endif
+)
 {
 	int		ret = ZBX_DB_OK, last_txn_error, last_txn_level;
 #if defined(HAVE_IBM_DB2)
@@ -385,6 +393,9 @@
 #else
 	my_bool		mysql_reconnect = 1;
 #endif
+#ifdef DBTLS
+	unsigned char	use_tls;
+#endif
 #elif defined(HAVE_ORACLE)
 	char		*connect = NULL;
 	sword		err = OCI_SUCCESS;
@@ -501,6 +512,25 @@
 		exit(EXIT_FAILURE);
 	}
 
+#ifdef DBTLS
+	/* if at least one of DB TLS parameters was provided, pass them to MySQL and require secure connection */
+	if (NULL != key || NULL != cert || NULL != ca || NULL != capath || NULL != cipher)
+	{
+		my_bool	verify = 1;
+
+		use_tls = 1;
+
+		mysql_ssl_set(conn, key, cert, ca, capath, cipher);
+		mysql_options(conn, MYSQL_OPT_SSL_VERIFY_SERVER_CERT, (void *)&verify);
+	}
+	else
+	{
+		use_tls = 0;
+		zabbix_log(LOG_LEVEL_WARNING, "None of encryption parameters was provided. Database connection is going"
+				" to be unencrypted.");
+	}
+#endif
+
 	if (NULL == mysql_real_connect(conn, host, user, password, dbname, port, dbsocket, CLIENT_MULTI_STATEMENTS))
 	{
 		zbx_db_errlog(ERR_Z3001, mysql_errno(conn), mysql_error(conn), dbname);
@@ -507,6 +537,20 @@
 		ret = ZBX_DB_FAIL;
 	}
 
+#ifdef DBTLS
+	if (ZBX_DB_OK == ret && 1 == use_tls)
+	{
+		const char	*ssl_cipher;
+
+		if (NULL == (ssl_cipher = mysql_get_ssl_cipher(conn)))
+		{
+			zabbix_log(LOG_LEVEL_ERR, "cannot establish TLS to MySQL database");
+			ret = ZBX_DB_FAIL;
+		}
+		else
+			zabbix_log(LOG_LEVEL_DEBUG, "Cipher in use: \"%s\".", ssl_cipher);
+	}
+#endif
 	/* The RECONNECT option setting is placed here, AFTER the connection	*/
 	/* is made, due to a bug in MySQL versions prior to 5.1.6 where it	*/
 	/* reset the options value to the default, regardless of what it was	*/
Index: src/libs/zbxdbhigh/db.c
===================================================================
--- src/libs/zbxdbhigh/db.c	(revision 90475)
+++ src/libs/zbxdbhigh/db.c	(working copy)
@@ -71,7 +71,12 @@
 	zabbix_log(LOG_LEVEL_DEBUG, "In %s() flag:%d", __function_name, flag);
 
 	while (ZBX_DB_OK != (err = zbx_db_connect(CONFIG_DBHOST, CONFIG_DBUSER, CONFIG_DBPASSWORD,
-			CONFIG_DBNAME, CONFIG_DBSCHEMA, CONFIG_DBSOCKET, CONFIG_DBPORT)))
+			CONFIG_DBNAME, CONFIG_DBSCHEMA, CONFIG_DBSOCKET, CONFIG_DBPORT
+#ifdef DBTLS
+			, CONFIG_DB_KEY_FILE, CONFIG_DB_CERT_FILE, CONFIG_DB_CA_FILE, CONFIG_DB_CA_PATH
+			, CONFIG_DB_CIPHER
+#endif
+			)))
 	{
 		if (ZBX_DB_CONNECT_ONCE == flag)
 			break;
Index: src/zabbix_proxy/proxy.c
===================================================================
--- src/zabbix_proxy/proxy.c	(revision 90475)
+++ src/zabbix_proxy/proxy.c	(working copy)
@@ -220,6 +220,13 @@
 char	*CONFIG_DBSOCKET		= NULL;
 char	*CONFIG_EXPORT_DIR		= NULL;
 int	CONFIG_DBPORT			= 0;
+#ifdef DBTLS
+char	*CONFIG_DB_KEY_FILE		= NULL;
+char	*CONFIG_DB_CERT_FILE		= NULL;
+char	*CONFIG_DB_CA_FILE		= NULL;
+char	*CONFIG_DB_CA_PATH		= NULL;
+char	*CONFIG_DB_CIPHER		= NULL;
+#endif
 int	CONFIG_ENABLE_REMOTE_COMMANDS	= 0;
 int	CONFIG_LOG_REMOTE_COMMANDS	= 0;
 int	CONFIG_UNSAFE_USER_PARAMETERS	= 0;
@@ -699,6 +706,18 @@
 			PARM_OPT,	0,			0},
 		{"DBPort",			&CONFIG_DBPORT,				TYPE_INT,
 			PARM_OPT,	1024,			65535},
+#ifdef DBTLS
+		{"DBKeyFile",			&CONFIG_DB_KEY_FILE,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+		{"DBCertFile",			&CONFIG_DB_CERT_FILE,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+		{"DBCAFile",			&CONFIG_DB_CA_FILE,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+		{"DBCAPath",			&CONFIG_DB_CA_PATH,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+		{"DBCipher",			&CONFIG_DB_CIPHER,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+#endif
 		{"SSHKeyLocation",		&CONFIG_SSH_KEY_LOCATION,		TYPE_STRING,
 			PARM_OPT,	0,			0},
 		{"LogSlowQueries",		&CONFIG_LOG_SLOW_QUERIES,		TYPE_INT,
Index: src/zabbix_server/server.c
===================================================================
--- src/zabbix_server/server.c	(revision 90475)
+++ src/zabbix_server/server.c	(working copy)
@@ -233,6 +233,13 @@
 char	*CONFIG_DBSOCKET		= NULL;
 char	*CONFIG_EXPORT_DIR		= NULL;
 int	CONFIG_DBPORT			= 0;
+#ifdef DBTLS
+char	*CONFIG_DB_KEY_FILE		= NULL;
+char	*CONFIG_DB_CERT_FILE		= NULL;
+char	*CONFIG_DB_CA_FILE		= NULL;
+char	*CONFIG_DB_CA_PATH		= NULL;
+char	*CONFIG_DB_CIPHER		= NULL;
+#endif
 int	CONFIG_ENABLE_REMOTE_COMMANDS	= 0;
 int	CONFIG_LOG_REMOTE_COMMANDS	= 0;
 int	CONFIG_UNSAFE_USER_PARAMETERS	= 0;
@@ -697,6 +704,18 @@
 			PARM_OPT,	0,			0},
 		{"DBPort",			&CONFIG_DBPORT,				TYPE_INT,
 			PARM_OPT,	1024,			65535},
+#ifdef DBTLS
+		{"DBKeyFile",			&CONFIG_DB_KEY_FILE,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+		{"DBCertFile",			&CONFIG_DB_CERT_FILE,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+		{"DBCAFile",			&CONFIG_DB_CA_FILE,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+		{"DBCAPath",			&CONFIG_DB_CA_PATH,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+		{"DBCipher",			&CONFIG_DB_CIPHER,			TYPE_STRING,
+			PARM_OPT,	0,			0},
+#endif
 		{"SSHKeyLocation",		&CONFIG_SSH_KEY_LOCATION,		TYPE_STRING,
 			PARM_OPT,	0,			0},
 		{"LogSlowQueries",		&CONFIG_LOG_SLOW_QUERIES,		TYPE_INT,
