[Create/copy certificate into location]
If you have a certificate and key from Let’s Encrypt, here’s how to repurpose them for MySQL:
# cp /etc/letsencrypt/live/example.com/fullchain.pem /etc/mysql/fullchain.pem
# openssl rsa -in /etc/letsencrypt/live/example.com/privkey.pem -out /etc/mysql/privkey.pem
# chmod 444 /etc/mysql/fullchain.pem
# chmod 400 /etc/mysql/privkey.pem
# chown mysql:mysql /etc/mysql/fullchain.pem /etc/mysql/privkey.pem
Note that you’ll probably want to use a hook to automatically do this every time 
that the certificate is renewed if you’re using Let’s Encrypt.
If your MySQL instance runs as a different user, modify the chown command accordingly.
[Update MySQL config]
# vi /etc/mysql/my.cnf and add the following lines to the 
[mysqld]
bind-address = 1.2.3.4
ssl-cert=/etc/mysql/fullchain.pem
ssl-key=/etc/mysql/privkey.pem

Substitute 1.2.3.4 with the IP address of your server.
[Restart MySQL]
# systemctl restart mysql

秘密鍵のエラーが出る時は (OpenSSL のバージョンの問題らしい)、
$ openssl rsa -in XXX-key.pem -out XXX-key-pkcs1.pem