The MySQL Keyring •Pausing keyring operations during an online migration is accomplished by connecting to the running server and setting its global  keyring_operations  system variable to  OFF  before key copying and  ON after key copying. This has several implications: • keyring_operations  was introduced in MySQL 5.7.21, so online migration is possible only if the running server is from MySQL 5.7.21 or higher. If the running server is older, you must stop it, perform an offline migration, and restart it. All migration instructions elsewhere that refer to keyring_operations  are subject to this condition. •The account used to connect to the running server must have the privileges required to modify keyring_operations . These privileges are  ENCRYPTION_KEY_ADMIN  in addition to either SYSTEM_VARIABLES_ADMIN  or the deprecated  SUPER  privilege. •If an online migration operation exits abnormally (for example, if it is forcibly terminated), it is possible for  keyring_operations  to remain disabled on the running server, leaving it unable to perform keyring operations. In this case, it may be necessary to connect to the running server and enable keyring_operations  manually using this statement: •Online key migration provides for pausing keyring operations on a single running server. To perform a migration if multiple running servers are using the keystores involved, use the procedure described at Key Migration Involving Multiple Running Servers. SET GLOBAL keyring_operations = ON; A MySQL server becomes a migration server if invoked in a special operational mode that supports key migration. A migration server does not accept client connections. Instead, it runs only long enough to migrate keys, then exits. A migration server reports errors to the console (the standard error output). A migration server supports these migration types: Key Migration Using a Migration Server •Migration from one keyring plugin to another. •Migration from a keyring plugin to a keyring component. This capability is available as of MySQL 8.0.24. Older servers support only migration from one keyring plugin to another, in which case the parts of these instructions that refer to keyring components do not apply. •To indicate the source keyring plugin and the destination keyring plugin or component, specify these options: • --keyring-migration-source : The source keyring plugin that manages the keys to be migrated. • --keyring-migration-destination : The destination keyring plugin or component to which the migrated keys are to be copied. • --keyring-migration-to-component : This option is required if the destination is a keyring component rather than a keyring plugin. A migration server does not support migration from one keyring component to another. For that type of migration, see Key Migration Using the mysql_migrate_keyring Utility. To perform a key migration operation using a migration server, determine the key migration options required to specify which keyring plugins or components are involved, and whether the migration is offline or online: The  --keyring-migration-source  and  --keyring-migration-destination  options signify to the server that it should run in key migration mode. For key migration operations, both options are 1432