innodb_undo_directory innodb_undo_tablespaces keyring_encrypted_file_data keyring_encrypted_file_password lc_messages_dir log_error mecab_rc_file named_pipe pid_file plugin_dir port relay_log relay_log_info_file secure_file_priv sha256_password_auto_generate_rsa_keys sha256_password_private_key_path sha256_password_public_key_path shared_memory shared_memory_base_name skip_networking slave_load_tmpdir socket ssl_ca ssl_capath ssl_cert ssl_crl ssl_crlpath ssl_key tmpdir version_tokens_session_number 

To configure the server to enable persisting persist-restricted system variables, use this procedure: 

1. Ensure that MySQL is configured to support encrypted connections. See Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . 

2. Designate an SSL certificate X.509 Subject value that signifies the ability to persist persist-restricted system variables, and generate a certificate that has that Subject. See Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . 

3. Start the server with persist_only_admin_x509_subject  set to the designated Subject value. For example, put these lines in your server my.cnf  file: 

[mysqld] persist_only_admin_x509_subject=" subject-value " 

The format of the Subject value is the same as used for CREATE USER ... REQUIRE SUBJECT . See Section 13.7.1.3, “CREATE USER Statement” . 

You must perform this step directly on the MySQL server host because persist_only_admin_x509_subject  itself cannot be persisted at runtime. 

4. Restart the server. 

5. Distribute the SSL certificate that has the designated Subject value to users who are to be permitted to persist persist-restricted system variables. 

Suppose that myclient-cert.pem  is the SSL certificate to be used by clients who can persist persist- restricted system variables. Display the certificate contents using the openssl  command: 

shell> openssl x509 -text -in myclient-cert.pem Certificate: Data: 

