Using System Variables innodb_undo_directory innodb_undo_tablespaces keyring_encrypted_file_data keyring_encrypted_file_password lc_messages_dir log_error mecab_rc_file named_pipe pid_file plugin_dir port relay_log relay_log_info_file secure_file_priv sha256_password_auto_generate_rsa_keys sha256_password_private_key_path sha256_password_public_key_path shared_memory shared_memory_base_name skip_networking slave_load_tmpdir socket ssl_ca ssl_capath ssl_cert ssl_crl ssl_crlpath ssl_key tmpdir version_tokens_session_number To configure the server to enable persisting persist-restricted system variables, use this procedure: The format of the Subject value is the same as used for  CREATE USER ... REQUIRE SUBJECT . See Section 13.7.1.3, “CREATE USER Statement” . You must perform this step directly on the MySQL server host because persist_only_admin_x509_subject  itself cannot be persisted at runtime. Suppose that  myclient-cert.pem  is the SSL certificate to be used by clients who can persist persist- restricted system variables. Display the certificate contents using the  openssl  command: 944 shell>  openssl x509 -text -in myclient-cert.pem Certificate: Data: [mysqld] persist_only_admin_x509_subject=" subject-value " 5. Distribute the SSL certificate that has the designated Subject value to users who are to be permitted to persist persist-restricted system variables. 4. Restart the server. 3. Start the server with  persist_only_admin_x509_subject  set to the designated Subject value. For example, put these lines in your server  my.cnf  file: 2. Designate an SSL certificate X.509 Subject value that signifies the ability to persist persist-restricted system variables, and generate a certificate that has that Subject. See Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . 1. Ensure that MySQL is configured to support encrypted connections. See Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” .