[TLS] no way to specify that connection should use TLS

[ifsnop]

You can define certs in the dumpSettings array prior to calling start();

$options = array( PDO::MYSQL_ATTR_SSL_CA => '/path/to/cacert.pem', PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => false, );