REVOKE takes a right away, and you don't need FLUSH PRIVILEGES after it. The surprise is timing: a session that's already open can keep a database-level right until it next runs USE. I tested it in two sessions, and with a running app.

Your app reads and changes rows. It doesn't need to drop tables, and if it can't, then neither can a bug in it or an injected query. Here's an account with exactly those four rights, on one database.

Before you change an account's rights, or wonder why something's refused, ask MySQL what the account can do. SHOW GRANTS answers in a line or two, once you know how to read them.

MySQL 9.7 accepts TLS 1.2 and 1.3 by default. To allow only 1.3, one setting and one reload do it, with no restart. Before you do, check your clients: MySql.Data for .NET asks for TLS 1.2 unless you tell it otherwise, so it would stop connecting.

REQUIRE X509 adds a second factor to a MySQL account: as well as the password, it must present a certificate signed by the server's CA. The mysql client handles this well. .NET's MySql.Data has a catch, and it's in here too.

To make one MySQL account use TLS, whatever the others do, add REQUIRE SSL. It's stricter than the server-wide setting: a local socket isn't good enough, and the refusal gives no reason, so know both before you turn it on.

A client can ask for TLS, but only the server can insist on it. require_secure_transport refuses any connection without it, for every account, so one wrong connection string can't quietly turn encryption off.

The MySQL image makes its own certificates, and it will use yours if you point it at them. That takes a mount and three options in compose.yaml, plus one thing to get right on Linux: who owns the key.

A client that checks host names can't pass against MySQL's automatic certificate, because that certificate has no name you could connect to. You don't need a new CA or any extra tools: the container has OpenSSL and the CA's key, so you can sign a certificate with the right name right there.

MySQL reads its certificate files when it starts, so replacing a file changes nothing by itself. ALTER INSTANCE RELOAD TLS makes it read them again, with no restart, and connections already open aren't touched.