We don't have an option that functions like ssl_mode=REQUIRED.

Before adding an option like ssl_mode, we will consider organizing the TLS-related options and providing a safer and simpler option system.
The current TLS-related options are as follows:

:param ssl: A dict of arguments similar to mysql_ssl_set()'s parameters or an ssl.SSLContext.
:param ssl_ca: Path to the file that contains a PEM-formatted CA certificate.
:param ssl_cert: Path to the file that contains a PEM-formatted client certificate.
:param ssl_disabled: A boolean value that disables usage of TLS.
:param ssl_key: Path to the file that contains a PEM-formatted private key for
    the client certificate.
:param ssl_key_password: The password for the client certificate private key.
:param ssl_verify_cert: Set to true to check the server certificate's validity.
:param ssl_verify_identity: Set to true to check the server's identity.

ssl_disabled is currently a completely meaningless option. It was ported from MySQL Connector/Python, but since c/p does not have ssl, ssl_disabled existed.

I am considering a change to reorganize the overall behavior without adding options. Following conditions are evaluated in order from the top.

1. If ssl_disabled is true, prohibit ssl connection.
2. If either ssl_verify_cert or ssl_verify_identity is true, require ssl connection.
3. If an SSLContext is passed to ssl, also require ssl connection.
4. If none of the above options are specified, behave as if ssl_mode="PREFERRED".

Attempting TLS connection when no options are specified is a big change, but the official MySQL client also made this change.