diff --git a/changelog.md b/changelog.md
index 42a5a92e..d6eb4e94 100644
--- a/changelog.md
+++ b/changelog.md
@@ -5,6 +5,7 @@ Features
 --------
 * Options to limit size of LLM prompts; cache LLM prompt data.
 * Add startup usage tips.
+* Move `main.ssl_mode` config option to `connection.default_ssl_mode`.
 
 
 Bug Fixes
diff --git a/mycli/main.py b/mycli/main.py
index 5c1ce7cf..ea55ab68 100755
--- a/mycli/main.py
+++ b/mycli/main.py
@@ -180,7 +180,7 @@ def __init__(
             self.llm_prompt_section_truncate = 0
 
         # set ssl_mode if a valid option is provided in a config file, otherwise None
-        ssl_mode = c["main"].get("ssl_mode", None)
+        ssl_mode = c["main"].get("ssl_mode", None) or c["connection"].get("default_ssl_mode", None)
         if ssl_mode not in ("auto", "on", "off", None):
             self.echo(f"Invalid config option provided for ssl_mode ({ssl_mode}); ignoring.", err=True, fg="red")
             self.ssl_mode = None
diff --git a/mycli/myclirc b/mycli/myclirc
index 6f1a42d7..1bb8b430 100644
--- a/mycli/myclirc
+++ b/mycli/myclirc
@@ -5,13 +5,6 @@
 # after executing a SQL statement when applicable.
 show_warnings = False
 
-# Sets the desired behavior for handling secure connections to the database server.
-# Possible values:
-# auto = SSL is preferred. Will attempt to connect via SSL, but will fallback to cleartext as needed.
-# on = SSL is required. Will attempt to connect via SSL and will fail if a secure connection is not established.
-# off = do not use SSL. Will fail if the server requires a secure connection.
-ssl_mode = auto
-
 # Enables context sensitive auto-completion. If this is disabled the all
 # possible completions will be listed.
 smart_completion = True
@@ -157,6 +150,13 @@ default_character_set = utf8mb4
 # whether to enable LOAD DATA LOCAL INFILE for connections without --local-infile being set
 default_local_infile = False
 
+# Sets the desired behavior for handling secure connections to the database server.
+# Possible values:
+# auto = SSL is preferred. Will attempt to connect via SSL, but will fallback to cleartext as needed.
+# on = SSL is required. Will attempt to connect via SSL and will fail if a secure connection is not established.
+# off = do not use SSL. Will fail if the server requires a secure connection.
+default_ssl_mode = auto
+
 # SSL CA file for connections without --ssl-ca being set
 default_ssl_ca =
 
diff --git a/test/myclirc b/test/myclirc
index ea4e1497..aff7137d 100644
--- a/test/myclirc
+++ b/test/myclirc
@@ -5,13 +5,6 @@
 # after executing a SQL statement when applicable.
 show_warnings = False
 
-# Sets the desired behavior for handling secure connections to the database server.
-# Possible values:
-# auto = SSL is preferred. Will attempt to connect via SSL, but will fallback to cleartext as needed.
-# on = SSL is required. Will attempt to connect via SSL and will fail if a secure connection is not established.
-# off = do not use SSL. Will fail if the server requires a secure connection.
-ssl_mode = auto
-
 # Enables context sensitive auto-completion. If this is disabled the all
 # possible completions will be listed.
 smart_completion = True
@@ -155,6 +148,13 @@ default_character_set = utf8mb4
 # whether to enable LOAD DATA LOCAL INFILE for connections without --local-infile being set
 default_local_infile = False
 
+# Sets the desired behavior for handling secure connections to the database server.
+# Possible values:
+# auto = SSL is preferred. Will attempt to connect via SSL, but will fallback to cleartext as needed.
+# on = SSL is required. Will attempt to connect via SSL and will fail if a secure connection is not established.
+# off = do not use SSL. Will fail if the server requires a secure connection.
+default_ssl_mode = auto
+
 # SSL CA file for connections without --ssl-ca being set
 default_ssl_ca =