Authentication Plugins To enable use of an RSA key pair for password exchange during the client connection process, use the following procedure: Otherwise, to name the key files explicitly, set the system variables to the key file names in the server option file. If the files are located in the server data directory, you need not specify their full path names: If the key files are not located in the data directory, or to make their locations explicit in the system variable values, use full path names: If the value is empty, the server found some problem with the key files. Check the error log for diagnostic information. After the server has been configured with the RSA key files, accounts that authenticate with the caching_sha2_password  plugin have the option of using those key files to connect to the server. As mentioned previously, such accounts can use either a secure connection (in which case RSA is not used) or an unencrypted connection that performs password exchange using RSA. Suppose that an unencrypted connection is used. For example: For this connection attempt by  sha2user , the server determines that  caching_sha2_password  is the appropriate authentication plugin and invokes it (because that was the plugin specified at  CREATE USER  time). The plugin finds that the connection is not encrypted and thus requires the password to be 1310 4. Restart the server, then connect to it and check the  Caching_sha2_password_rsa_public_key status variable value. The value actually displayed differs from that shown here, but should be nonempty: 3. If you want to change the number of hash rounds used by  caching_sha2_password  during password generation, set the  caching_sha2_password_digest_rounds  system variable. For example: 2. If the private and public key files are located in the data directory and are named  private_key.pem and  public_key.pem  (the default values of the  caching_sha2_password_private_key_path and  caching_sha2_password_public_key_path  system variables), the server uses them automatically at startup. 1. Create the RSA private and public key-pair files using the instructions in Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . [mysqld] caching_sha2_password_private_key_path=myprivkey.pem caching_sha2_password_public_key_path=mypubkey.pem [mysqld] caching_sha2_password_private_key_path=/usr/local/mysql/myprivkey.pem caching_sha2_password_public_key_path=/usr/local/mysql/mypubkey.pem [mysqld] caching_sha2_password_digest_rounds=10000 mysql>  SHOW STATUS LIKE ’Caching_sha2_password_rsa_public_key’\G *************************** 1. row *************************** Variable_name: Caching_sha2_password_rsa_public_key Value: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDO9nRUDd+KvSZgY7cNBZMNpwX6 MvE1PbJFXO7u18nJ9lwc99Du/E7lw6CVXw7VKrXPeHbVQUzGyUNkf45Nz/ckaaJa aLgJOBCIDmNVnyU54OT/1lcs2xiyfaDMe8fCJ64ZwTnKbY2gkt1IMjUAB5Ogd5kJ g8aV7EtKwyhHb0c30QIDAQAB -----END PUBLIC KEY----- shell>  mysql --ssl-mode=DISABLED -u sha2user -p Enter password:  password