A keyring migration copies keys from one keystore to another, enabling a DBA to switch a MySQL installation to a different keystore. A successful migration operation has this result: 

•The destination keystore contains the keys it had prior to the migration, plus the keys from the source keystore. 

•The source keystore remains the same before and after the migration (because keys are copied, not moved). 

If a key to be copied already exists in the destination keystore, an error occurs and the destination keystore is restored to its premigration state. 

The keyring manages keystores using keyring components and keyring plugins. This pertains to migration strategy because the way in which the source and destination keystores are managed determines whether a particular type of key migration is possible and the procedure for performing it: 

•Migration from one keyring plugin to another: The MySQL server has an operational mode that provides this capability. 

•Migration from a keyring plugin to a keyring component: The MySQL server has an operational mode that provides this capability as of MySQL 8.0.24. 

•Migration from one keyring component to another: The mysql_migrate_keyring  utility provides this capability. mysql_migrate_keyring  is available as of MySQL 8.0.24. 

•Migration from a keyring component to a keyring plugin: There is no provision for this capability. 

The following sections discuss the characteristics of offline and online migrations and describe how to perform migrations. 

## Offline and Online Key Migrations 

•Offline and Online Key Migrations 

•Key Migration Using a Migration Server 

•Key Migration Using the mysql_migrate_keyring Utility 

•Key Migration Involving Multiple Running Servers 

A key migration is either offline or online: 

•Offline migration: For use when you are sure that no running server on the local host is using the source or destination keystore. In this case, the migration operation can copy keys from the source keystore to the destination without the possibility of a running server modifying keystore content during the operation. 

•Online migration: For use when a running server on the local host is using the source keystore. In this case, care must be taken to prevent that server from updating keystores during the migration. This involves connecting to the running server and instructing it to pause keyring operations so that keys can be copied safely from the source keystore to the destination. When key copying is complete, the running server is permitted to resume keyring operations. 

When you plan a key migration, use these points to decide whether it should be offline or online: 

•Do not perform offline migration involving a keystore that is in use by a running server. 

