If you want to connect to a cluster running Exasol 7.0.x or earlier with a recent Exasol Virtual Schema (5.0.4 or later), you should explicitly disable TLS on in the JDBC connection the Virtual Schema uses, otherwise the driver will attempt to establish a TLS connection to the server that does not support it and the connection attempt will fail.
If DB is running 6.2.0..14 or 7.0.0..9, then after the initial handshake driver will switch to legacy encryption.
End result:
DB versions 6.2.15+ and 7.0.10+ fully support TLS.
DB versions 6.2.0..14 or 7.0.0..9 will work with 7.1 driver even without legacyencryption=1. However, it makes sense to disable TLS while connecting to these DB versions as the actual communication will happen via legacy encryption.
For DB versions prior to 6.2 legacyencryption=1 should be used.
The current info on TLS in the user guide (the paragraph cited above) is somewhat wrong and misleading.
The paragraph
from Exasol SQL Dialect needs to be amended.
End result: