mysql_ssl_rsa_setup — Create SSL/RSA Files Another way to generate SSL and RSA files, for MySQL distributions compiled using OpenSSL, is to have the server generate them automatically. See Section 6.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL” . mysql_ssl_rsa_setup  helps lower the barrier to using SSL by making it easier to generate the required files. However, certificates generated by mysql_ssl_rsa_setup  are self-signed, which is not very secure. After you gain experience using the files created by  mysql_ssl_rsa_setup , consider obtaining a CA certificate from a registered certificate authority. Invoke  mysql_ssl_rsa_setup  like this: Typical options are  --datadir  to specify where to create the files, and  --verbose  to see the  openssl commands that  mysql_ssl_rsa_setup  executes. mysql_ssl_rsa_setup  attempts to create SSL and RSA files using a default set of file names. It works as follows: These files enable secure client connections using SSL; see Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . For information about the characteristics of files created by  mysql_ssl_rsa_setup , see Section 6.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL” . 401 5. If any of these files are present,  mysql_ssl_rsa_setup  creates no RSA files. Otherwise, it invokes openssl  to create them. These files enable secure password exchange using RSA over unencrypted connections for accounts authenticated by the  sha256_password  or  caching_sha2_password plugin; see Section 6.4.1.3, “SHA-256 Pluggable Authentication” , and Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication” . 4. mysql_ssl_rsa_setup  checks the data directory for RSA files with the following names: ca.pem server-cert.pem server-key.pem mysql_ssl_rsa_setup [ options ] ca.pem Self-signed CA certificate ca-key.pem CA private key server-cert.pem Server certificate server-key.pem Server private key client-cert.pem Client certificate client-key.pem Client private key private_key.pem Private member of private/public key pair public_key.pem Public member of private/public key pair 1. mysql_ssl_rsa_setup  checks for the  openssl  binary at the locations specified by the  PATH environment variable. If  openssl  is not found,  mysql_ssl_rsa_setup  does nothing. If  openssl is present,  mysql_ssl_rsa_setup  looks for default SSL and RSA files in the MySQL data directory specified by the  --datadir  option, or the compiled-in data directory if the  --datadir  option is not given. 2. mysql_ssl_rsa_setup  checks the data directory for SSL files with the following names: 3. If any of those files are present,  mysql_ssl_rsa_setup  creates no SSL files. Otherwise, it invokes openssl  to create them, plus some additional files: Important