ownership and permissions if necessary using chown , chmod , or similar commands, so that the objects are accessible to the running server. 

Example command line for offline migration between two keyring plugins (enter the command on a single line): 

mysqld --defaults-file=/usr/local/mysql/etc/my.cnf --keyring-migration-source=keyring_file.so --keyring-migration-destination=keyring_encrypted_file.so --keyring_encrypted_file_password= password 

Example command line for online migration between two keyring plugins: 

mysqld --defaults-file=/usr/local/mysql/etc/my.cnf --keyring-migration-source=keyring_file.so --keyring-migration-destination=keyring_encrypted_file.so --keyring_encrypted_file_password= password --keyring-migration-host=127.0.0.1 --keyring-migration-user=root --keyring-migration-password= root_password 

To perform a migration when the destination is a keyring component rather than a keyring plugin, specify the --keyring-migration-to-component  option, and name the component as the value of the -- keyring-migration-destination  option. 

Example command line for offline migration from a keyring plugin to a keyring component: 

mysqld --defaults-file=/usr/local/mysql/etc/my.cnf --keyring-migration-to-component --keyring-migration-source=keyring_file.so --keyring-migration-destination=component_keyring_encrypted_file.so 

Notice that in this case, no keyring_encrypted_file_password  value is specified. The password for the component data file is listed in the component configuration file. 

Example command line for online migration from a keyring plugin to a keyring component: 

mysqld --defaults-file=/usr/local/mysql/etc/my.cnf --keyring-migration-to-component --keyring-migration-source=keyring_file.so --keyring-migration-destination=component_keyring_encrypted_file.so --keyring-migration-host=127.0.0.1 --keyring-migration-user=root --keyring-migration-password= root_password 

The key migration server performs a migration operation as follows: 

1. (Online migration only) Connect to the running server using the connection options. 

2. (Online migration only) Disable keyring_operations  on the running server. 

3. Load the keyring plugin/component libraries for the source and destination keystores. 

4. Copy keys from the source keystore to the destination. 

5. Unload the keyring plugin/component libraries for the source and destination keystores. 

6. (Online migration only) Enable keyring_operations  on the running server. 

7. (Online migration only) Disconnect from the running server. 

If an error occurs during key migration, the destination keystore is restored to its premigration state. 

