Connections using insecure transport are prohibited while --require_secure_transport=ON is the server refusing a connection with no TLS, on purpose. MySql.Data puts Authentication to host … failed in front of it, but your password is fine. Your connection string needs TLS turned on.
An account with REQUIRE X509 must present a client certificate. I gave MySql.Data the right one, in SslCert and SslKey, and got Access denied, though the mysql client got in with the same files. The driver reads those PEM files and never sends them.
The host 127.0.0.1 does not support SSL connections means the server didn't offer TLS at all. Mine had offered it a minute before. I'd reloaded its certificates with a wrong key and NO ROLLBACK ON ERROR, which does exactly what it says: when the reload fails, TLS stays off.
TLS protocols TLSv1 and TLSv1.1 are no longer supported is a clear message, and it comes before any connection is attempted: TlsVersion in your connection string names a version the driver has dropped. Change it to what's accepted.
Asking for TLS 1.3 on a Mac gave me The requested security protocol is not supported, though MySQL and .NET 10 both support it. By default, .NET on macOS uses a TLS library that doesn't, and there's a switch to use the one that does.
Cannot determine the frame size or a corrupted frame was received sounds like a damaged network. Nothing was damaged. The driver asked for TLS 1.2, and the server only accepts TLS 1.3, and this is how that disagreement reads from the client's side.
certificate expired on 20210101000000Z is exactly what it says: the server's certificate has run out, and VerifyCA and VerifyFull refuse it. What makes this one dangerous is SslMode=Required, which keeps connecting as if nothing had happened.
I gave SslCa the right CA as a .pfx file, and the driver refused a server it should have accepted. With SslMode=VerifyCA or VerifyFull, the PFX route refused every time I tried it, on macOS and on Linux. The same CA as a .pem file worked at once.
Failed to read file at the specified location is the driver saying it can't open the file you named. The same relative path worked in one terminal and failed in another, because a relative path depends on the folder the app starts in, and that isn't always the folder you're in.
The host name does not match the name on the certificate is VerifyFull doing the one thing it adds: comparing Server= in your connection string with the names in the server's certificate. MySQL's automatic certificate has no name you could connect to, so against that certificate it can never pass.
