Authentication Plugins •On the server side, two system variables name the RSA private and public key-pair files:  caching_sha2_password_private_key_path  and caching_sha2_password_public_key_path . The database administrator must set these variables at server startup if the key files to use have names that differ from the system variable default values. •The server uses the  caching_sha2_password_auto_generate_rsa_keys  system variable to determine whether to automatically generate the RSA key-pair files. See Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . •The  Caching_sha2_password_rsa_public_key  status variable displays the RSA public key value used by the  caching_sha2_password  authentication plugin. •Clients that are in possession of the RSA public key can perform RSA key pair-based password exchange with the server during the connection process, as described later. •For connections by accounts that authenticate with  caching_sha2_password  and RSA key pair- based password exchange, the server does not send the RSA public key to clients by default. Clients can use a client-side copy of the required public key, or request the public key from the server. •For command-line clients, use the  --server-public-key-path  option to specify the RSA public key file. Use the  --get-server-public-key  option to request the public key from the server. The following programs support the two options:  mysql ,  mysqlsh ,  mysqladmin ,  mysqlbinlog , mysqlcheck ,  mysqldump ,  mysqlimport ,  mysqlpump ,  mysqlshow ,  mysqlslap ,  mysqltest , mysql_upgrade . •For programs that use the C API, call  mysql_options()  to specify the RSA public key file by passing the  MYSQL_SERVER_PUBLIC_KEY  option and the name of the file, or request the public key from the server by passing the  MYSQL_OPT_GET_SERVER_PUBLIC_KEY  option. •For replicas, use the  CHANGE REPLICATION SOURCE TO  statement (from MySQL 8.0.23) or CHANGE MASTER TO  statement (before MySQL 8.0.23) with the  SOURCE_PUBLIC_KEY_PATH |  MASTER_PUBLIC_KEY_PATH  option to specify the RSA public key file, or the GET_SOURCE_PUBLIC_KEY  |  GET_MASTER_PUBLIC_KEY  option to request the public key from the source. For Group Replication, the  group_replication_recovery_public_key_path  and group_replication_recovery_get_public_key  system variables serve the same purpose. •If the connection is secure, an RSA key pair is unnecessary and is not used. This applies to TCP connections encrypted using TLS, as well as Unix socket-file and shared-memory connections. The password is sent as cleartext but cannot be snooped because the connection is secure. •If the connection is not secure, an RSA key pair is used. This applies to TCP connections not encrypted using without TLS and named-pipe connections. RSA is used only for password exchange between client and server, to prevent password snooping. When the server receives the encrypted password, it decrypts it. A scramble is used in the encryption to prevent repeat attacks. 1309 For clients that use the  caching_sha2_password  plugin, passwords are never exposed as cleartext when connecting to the server. How password transmission occurs depends on whether a secure connection or RSA encryption is used: In all cases, if the option is given to specify a valid public key file, it takes precedence over the option to request the public key from the server. Use of a trusted local copy of the public key enables the client to avoid a round trip in the client/ server protocol, and is more secure than requesting the public key from the server. On the other hand, requesting the public key from the server is more convenient (it requires no management of a client-side file) and may be acceptable in secure network environments.