RDS MySQL 8.4.11 post-quantum TLS: the claim its release notes do not make

Summary. On 24 August 2026 AWS announced MySQL minor version 8.4.11 on Amazon RDS and led with a security headline: "MySQL 8.4.11 introduces support for post-quantum TLS (PQ-TLS) key exchange." The MySQL 8.4.11 community release notes, dated 28 July 2026, contain no such entry. Oracle's own engineering blog, published the same day, puts post-quantum key exchange in MySQL 26.7.0 and makes it conditional on OpenSSL 3.5. AWS documentation states that RDS for MySQL 8.4 and higher links AWS-LC, not OpenSSL. Two further details in the same announcement do not survive a check either: 8.4.11 is described as "the latest minor released by community MySQL" although 8.4.12 shipped on 18 August 2026, and the post says "starting today" while the RDS user guide records the RDS release date as 21 August 2026. The part that actually costs money is elsewhere in that guide: MySQL 8.4.5 and 8.4.6 reach RDS end of standard support on 31 October 2026, 67 days from today, and minor versions are not eligible for RDS Extended Support at any price. For comparison, MySQL 8.0 Extended Support in us-east-1 bills $0.085 per vCPU-hour in years one and two.

What the announcement says, and what each primary says

The gap is not a matter of emphasis. Three separate claims in a short post disagree with the sources those claims depend on.

Claim in the AWS post, 24 Aug 2026	What the primary source says	Where
"MySQL 8.4.11 introduces support for post-quantum TLS (PQ-TLS) key exchange"	The 8.4.11 release notes have sections for audit log, compilation, deprecation, InnoDB, JSON, programs, optimizer, packaging, performance schema, replication, X Plugin and bugs fixed. No security section, no PQC entry.	MySQL 8.4.11 release notes
Post-quantum key exchange is a property of 8.4.11	"Starting with MySQL 26.7.0, MySQL can use the PQC-capable TLS algorithms provided by OpenSSL 3.5 and later."	Oracle MySQL blog, 28 July 2026
8.4.11 is "the latest minor released by community MySQL"	The 8.4 release notes list Changes in MySQL 8.4.12, dated 18 August 2026, six days before the AWS post.	MySQL 8.4 release notes
"Starting today" (24 August 2026)	The RDS user guide gives 8.4.11 an RDS release date of 21 August 2026.	RDS for MySQL version management

The OpenSSL precondition RDS cannot meet as written

Oracle's post is specific about what the feature needs. Miroslav Rajcic, Senior Software Developer at Oracle, writes: "Starting with MySQL 26.7.0, MySQL can use the PQC-capable TLS algorithms provided by OpenSSL 3.5 and later." The deployment guidance that follows opens with a single instruction: confirm that MySQL is linked with OpenSSL 3.5 or later.

That instruction cannot be followed on RDS. The RDS documentation is unambiguous: "For MySQL version 8.0 and lower, Amazon RDS for MySQL uses OpenSSL for secure connections. For MySQL version 8.4 and higher, Amazon RDS for MySQL uses AWS-LC." AWS-LC does carry post-quantum algorithms of its own, and version 5.5.0 was tagged on 5 August 2026, so the cryptography exists in the library. What does not exist in any published document is a statement that AWS has wired MySQL's PQC code paths, which Oracle gated on OpenSSL 3.5 APIs and shipped in a different release train, onto AWS-LC in the RDS 8.4 build.

The observable surface is missing too. Oracle's feature is driven by server variables: force_pqc, use_pqc_sign and tls_kex, each with per-channel siblings such as admin_tls_kex and replication_force_pqc. It is inspected through SHOW SESSION STATUS LIKE 'Tls_key_exchange_algorithm' and through Force_pqc, Use_pqc_sign and Tls_kex columns in performance_schema.tls_channel_status. None of those names appear anywhere in the RDS SSL/TLS pages. The RDS page for MySQL TLS support is a short page whose only technical content is a four-column table of TLS 1.0 through TLS 1.3 support by major version. It records TLS 1.3 as supported on MySQL 8.4 and 8.0, which is a precondition for PQC key exchange, and it says nothing beyond that.

The honest reading: TLS 1.3 is available, so a post-quantum group could in principle be negotiated if the server build supports it. Whether the RDS 8.4.11 build does is undocumented in either direction. Treat the announcement's security headline as unverified until an RDS parameter or status variable exposes the negotiated key exchange group.

The deadline the announcement does not mention

The RDS user guide's minor-version table is the part of this release worth acting on. It sets an end of standard support date for every 8.4 minor, and the near dates are close.

MySQL engine version	RDS release date	RDS end of standard support
8.4.11	21 August 2026	21 August 2027
8.4.10	7 July 2026	7 July 2027
8.4.9	8 May 2026	8 May 2027
8.4.8	3 February 2026	3 February 2027
8.4.7	13 November 2025	30 November 2026
8.4.6	1 August 2025	31 October 2026
8.4.5	29 April 2025	31 October 2026

Counting the rows above: seven supported 8.4 minors, two of which expire on the same day. From 25 August 2026, 8.4.5 and 8.4.6 have 67 days of standard support left and 8.4.7 has 97.

The shape of the window changed at 8.4.8. Every minor from 8.4.8 onward gets exactly twelve months from its RDS release date. The three older minors were instead floored on shared calendar dates, which gave 8.4.5 roughly eighteen months and 8.4.6 roughly fifteen. Anyone who has been reading the 8.4 line as "about eighteen months per minor" is working from the retired shape. The current shape is twelve months, and it starts on the RDS release date, not the community one.

The lag between the two dates matters because it eats the front of that window. Across the seven minors in the table the gap between community release and RDS release runs from 10 days for 8.4.6 to 24 days for 8.4.11, and the last three are 17, 21 and 24 days. The trend is upward.

No Extended Support escape hatch at minor-version granularity

This is the point that separates a MySQL 8.4 minor deadline from the MySQL 8.0 major deadline most teams already know about. The version management guide states plainly: "Amazon RDS Extended Support isn't available for minor versions." The Amazon RDS for MySQL pricing FAQ tightens it from the other side: "No, you must be on the latest engine minor to receive RDS Extended Support on your database."

So the paid safety net works only at major-version granularity, and only if you are current on minors. A database sitting on 8.4.5 on 1 November 2026 cannot buy its way out. The only remedy is a minor upgrade, either through the maintenance window with automatic minor version upgrades enabled, or through a blue/green deployment.

For contrast, here is what the major-version net costs when it does apply, taken from the AWS Price List data behind the RDS for MySQL pricing page, in US East (N. Virginia) and current as of 25 August 2026.

Engine version and year band	us-east-1 price per vCPU-hour	Applies from
MySQL 8.0, years 1 and 2	$0.085	1 August 2026
MySQL 8.0, year 3	$0.170	1 August 2028
MySQL 5.7, years 1 and 2	$0.100	1 March 2024
MySQL 5.7, year 3	$0.200	1 March 2026

MySQL 8.0 reached RDS end of standard support on 31 July 2026, and charges begin the day after that date. An 8 vCPU instance still on 8.0 therefore accrues 8 x $0.085 x 730 hours, or $496.40 per 730-hour month, and Extended Support charges apply to Multi-AZ standby instances as well. That is the number to put next to the cost of the upgrade project. The real cost is usually the migration, not the code. Teams already working through that arithmetic will find the same ground covered in our note on MySQL 8.0 end of life and RDS Extended Support, and the same no-extended-support pattern on the MariaDB side in the RDS MariaDB 12.3 LTS support window.

How to tell whether this is you

Four checks, in order, each of which resolves in minutes.

1. Run SELECT VERSION(); on every RDS for MySQL instance. If the answer starts 8.4.5 or 8.4.6, you have 67 days. If it starts 8.4.7, you have 97. If it starts 8.0, you are already paying.
2. Check whether AutoMinorVersionUpgrade is enabled on each instance. Where it is off, the 31 October 2026 date is a manual task on someone's calendar, not an automatic one.
3. Do not plan a security control around the post-quantum line in the announcement. If a regulator or customer contract requires quantum-safe key exchange in transit, ask AWS Support to confirm in writing whether the RDS 8.4.11 build negotiates a hybrid group such as X25519MLKEM768, and whether any parameter exposes tls_kex.
4. If the answer to point 3 matters to a live commitment, treat the database leg as unresolved and inventory the rest of the estate first. Our post-quantum cryptography readiness assessment covers the inventory step.

India-specific considerations

Teams operating under the Digital Personal Data Protection Act 2023 face a practical version of the same problem. DPDP obligations turn on reasonable security safeguards rather than on named algorithms, so a post-quantum key exchange is not required today. What the Act does not tolerate is a control described in a compliance register that the system does not actually implement. Writing "post-quantum TLS enabled, RDS MySQL 8.4.11" into a register on the strength of the AWS announcement would create exactly that gap, because no RDS document confirms the behaviour. The 31 October 2026 minor-version date is the more immediate item for Indian teams: an unpatched database past end of standard support is a straightforward safeguards finding, and it cannot be deferred with Extended Support.

What is still unknown

Three things. Whether the RDS 8.4.11 build carries MySQL's PQC key exchange at all. Whether AWS intends to expose tls_kex or force_pqc as RDS parameters. And whether MySQL 8.4.12, released by the community on 18 August 2026, reaches RDS before 8.4.5 and 8.4.6 expire on 31 October 2026. None of the three is answered by any page linked from the announcement.

FAQ

Does Amazon RDS for MySQL 8.4.11 support post-quantum TLS?

The AWS announcement of 24 August 2026 says it does. The MySQL 8.4.11 community release notes of 28 July 2026 list no post-quantum feature, and Oracle's blog places post-quantum key exchange in MySQL 26.7.0. No RDS document confirms the behaviour, so treat the claim as unverified.

Why does the OpenSSL requirement matter on RDS?

Oracle gates MySQL post-quantum key exchange on builds linked with OpenSSL 3.5 or later. AWS documentation states that RDS for MySQL 8.4 and higher uses AWS-LC rather than OpenSSL. The precondition Oracle publishes therefore cannot be checked the way Oracle describes on an RDS instance.

When do MySQL 8.4.5 and 8.4.6 lose support on RDS?

Both reach RDS end of standard support on 31 October 2026, which is 67 days from 25 August 2026. MySQL 8.4.7 follows on 30 November 2026. Every minor from 8.4.8 onward carries a twelve-month window measured from its RDS release date instead.

Can I buy Extended Support for an RDS MySQL minor version?

No. The RDS user guide states that Extended Support is not available for minor versions, and the Amazon RDS for MySQL pricing FAQ adds that you must be on the latest engine minor to receive Extended Support at all. The only remedy for an expiring minor is an upgrade.

What does RDS Extended Support cost for MySQL 8.0?

In US East (N. Virginia), $0.085 per vCPU-hour in years one and two and $0.170 in year three, current as of 25 August 2026. MySQL 8.0 reached RDS end of standard support on 31 July 2026, so charges started the following day, including on Multi-AZ standby instances.

Is MySQL 8.4.11 the newest community minor?

No. The MySQL 8.4 release notes list Changes in MySQL 8.4.12 dated 18 August 2026, six days before the AWS post that described 8.4.11 as the latest community minor. MySQL 8.4.12 had not reached Amazon RDS as of 25 August 2026.

How long does AWS take to ship a community MySQL minor on RDS?

Across the seven MySQL 8.4 minors in the RDS user guide table, the gap between the community release date and the RDS release date runs from 10 days for 8.4.6 to 24 days for 8.4.11. The three most recent gaps are 17, 21 and 24 days.

What should I check first on my own fleet?

Run SELECT VERSION(); on every RDS for MySQL instance, then confirm whether automatic minor version upgrades are enabled. Versions 8.4.5 and 8.4.6 expire on 31 October 2026, and with automatic upgrades disabled that date becomes a manual task rather than a maintenance-window one.

How eCorpIT can help

eCorpIT plans and runs database version upgrades on AWS, including blue/green cutovers for RDS for MySQL and the Extended Support cost modelling that decides whether an upgrade pays for itself. We are ISO 27001:2022 certified and CMMI Level 5 appraised, and we design database platforms aligned with DPDP Act requirements. If you are carrying MySQL 8.0 Extended Support charges or an 8.4 minor that expires on 31 October 2026, book an RDS upgrade review and we will map the versions, dates and costs against your fleet. Wider estate work sits under our cloud migration and modernisation service and our cloud FinOps guidance for Indian teams.

References

1. Amazon RDS for MySQL now supports new minor version 8.4.11, AWS What's New, 24 August 2026.
2. Changes in MySQL 8.4.11 (2026-07-28), MySQL 8.4 Release Notes, Oracle.
3. Post-Quantum Cryptography support in MySQL, Miroslav Rajcic, The Oracle MySQL Blog, 28 July 2026.
4. Upgrading the MySQL DB engine and version management, Amazon RDS User Guide.
5. SSL/TLS support for MySQL DB instances on Amazon RDS, Amazon RDS User Guide.
6. Using SSL/TLS to encrypt a connection to a DB instance or cluster, Amazon RDS User Guide.
7. Amazon RDS Extended Support with Amazon RDS, Amazon RDS User Guide.
8. Amazon RDS Extended Support charges, Amazon RDS User Guide.
9. Amazon RDS for MySQL pricing, Amazon Web Services, retrieved 25 August 2026.
10. aws/aws-lc, AWS-LC repository, release v5.5.0 tagged 5 August 2026.
11. Blue/green deployments for Amazon RDS, Amazon RDS User Guide.
12. DescribeDBInstances and AutoMinorVersionUpgrade, Amazon RDS User Guide.

Last updated: 25 August 2026.