After a successful online key migration operation, the running server might need to be restarted: 

•If the running server was using the source keystore before the migration and should continue to use it after the migration, it need not be restarted after the migration. 

•If the running server was using the destination keystore before the migration and should continue to use it after the migration, it should be restarted after the migration to load all keys migrated into the destination keystore. 

•If the running server was using the source keystore before the migration but should use the destination keystore after the migration, it must be reconfigured to use the destination keystore and restarted. In this case, be aware that although the running server is paused from modifying the source keystore during the migration itself, it is not paused during the interval between the migration and the subsequent restart. Care should be taken that the server does not modify the source keystore during this interval because any such changes will not be reflected in the destination keystore. 

## Key Migration Using the mysql_migrate_keyring Utility 

The mysql_migrate_keyring  utility migrates keys from one keyring component to another. It does not support migrations involving keyring plugins. For that type of migration, use a MySQL server operating in key migration mode; see Key Migration Using a Migration Server. 

To perform a key migration operation using mysql_migrate_keyring , determine the key migration options required to specify which keyring components are involved, and whether the migration is offline or online: 

•To indicate the source and destination keyring components and their location, specify these options: 

• --source-keyring : The source keyring component that manages the keys to be migrated. 

• --destination-keyring : The destination keyring component to which the migrated keys are to be copied. 

• --component-dir : The directory containing keyring component library files. This is typically the value of the plugin_dir  system variable for the local MySQL server. 

All three options are mandatory. Each keyring component name is a component library file name specified without any platform-specific extension such as .so  or .dll . For example, to use the component for which the library file is component_keyring_file.so , specify the option as -- source-keyring=component_keyring_file . The source and destination must differ, and mysql_migrate_keyring  must support them both. 

•For an offline migration, no additional options are needed. 

•For an online migration, some running server currently is using the source or destination keystore. In this case, specify the --online-migration  option to signify an online migration. In addition, specify connection options indicating how to connect to the running server, so that mysql_migrate_keyring can connect to it and tell it to pause keyring use during the migration operation. 

The --online-migration  option is commonly used in conjunction with connection options such as these: 

• --host : The host where the running server is located. This is always the local host because mysql_migrate_keyring  can migrate keys only between keystores managed by local components. 

• --user , --password : The account credentials to use to connect to the running server. 

• --port : For TCP/IP connections, the port number to connect to on the running server. 

