To enable use of an RSA key pair for password exchange during the client connection process, use the following procedure: 

1. Create the RSA private and public key-pair files using the instructions in Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . 

2. If the private and public key files are located in the data directory and are named private_key.pem and public_key.pem  (the default values of the caching_sha2_password_private_key_path and caching_sha2_password_public_key_path  system variables), the server uses them automatically at startup. 

Otherwise, to name the key files explicitly, set the system variables to the key file names in the server option file. If the files are located in the server data directory, you need not specify their full path names: 

[mysqld] caching_sha2_password_private_key_path=myprivkey.pem caching_sha2_password_public_key_path=mypubkey.pem 

If the key files are not located in the data directory, or to make their locations explicit in the system variable values, use full path names: 

[mysqld] caching_sha2_password_private_key_path=/usr/local/mysql/myprivkey.pem caching_sha2_password_public_key_path=/usr/local/mysql/mypubkey.pem 

3. If you want to change the number of hash rounds used by caching_sha2_password  during password generation, set the caching_sha2_password_digest_rounds  system variable. For example: 

[mysqld] caching_sha2_password_digest_rounds=10000 

4. Restart the server, then connect to it and check the Caching_sha2_password_rsa_public_key status variable value. The value actually displayed differs from that shown here, but should be nonempty: 

mysql> SHOW STATUS LIKE ’Caching_sha2_password_rsa_public_key’\G *************************** 1. row *************************** Variable_name: Caching_sha2_password_rsa_public_key Value: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDO9nRUDd+KvSZgY7cNBZMNpwX6 MvE1PbJFXO7u18nJ9lwc99Du/E7lw6CVXw7VKrXPeHbVQUzGyUNkf45Nz/ckaaJa aLgJOBCIDmNVnyU54OT/1lcs2xiyfaDMe8fCJ64ZwTnKbY2gkt1IMjUAB5Ogd5kJ g8aV7EtKwyhHb0c30QIDAQAB -----END PUBLIC KEY----- 

If the value is empty, the server found some problem with the key files. Check the error log for diagnostic information. 

After the server has been configured with the RSA key files, accounts that authenticate with the caching_sha2_password  plugin have the option of using those key files to connect to the server. As mentioned previously, such accounts can use either a secure connection (in which case RSA is not used) or an unencrypted connection that performs password exchange using RSA. Suppose that an unencrypted connection is used. For example: 

shell> mysql --ssl-mode=DISABLED -u sha2user -p Enter password: password 

For this connection attempt by sha2user , the server determines that caching_sha2_password  is the appropriate authentication plugin and invokes it (because that was the plugin specified at CREATE USER  time). The plugin finds that the connection is not encrypted and thus requires the password to be 

