Creating SSL and RSA Certificates and Keys +---------------+---------------------------+ | VARIABLE_NAME | VARIABLE_VALUE | +---------------+---------------------------+ | Ssl_cipher | DHE-RSA-AES128-GCM-SHA256 | | Ssl_version | TLSv1.2 | +---------------+---------------------------+ If the connection is not encrypted, both variables have an empty value. The following discussion describes how to create the files required for SSL and RSA support in MySQL. File creation can be performed using facilities provided by MySQL itself, or by invoking the  openssl command directly. SSL certificate and key files enable MySQL to support encrypted connections using SSL. See Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . RSA key files enable MySQL to support secure password exchange over unencrypted connections for accounts authenticated by the  sha256_password  or  caching_sha2_password  plugin. See Section 6.4.1.3, “SHA-256 Pluggable Authentication” , and Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication” . MySQL provides these ways to create the SSL certificate and key files and RSA key-pair files required to support encrypted connections using SSL and secure password exchange using RSA over unencrypted connections, if those files are missing: •The server can autogenerate these files at startup, for MySQL distributions. •Users can invoke the  mysql_ssl_rsa_setup  utility manually. •For some distribution types, such as RPM and DEB packages,  mysql_ssl_rsa_setup  invocation occurs during data directory initialization. In this case, the MySQL distribution need not have been compiled using OpenSSL as long as the  openssl  command is available. •Automatic SSL and RSA File Generation •Manual SSL and RSA File Generation Using mysql_ssl_rsa_setup •SSL and RSA File Characteristics 1296 For MySQL distributions compiled using OpenSSL, the MySQL server has the capability of automatically generating missing SSL and RSA files at startup. The auto_generate_certs ,  sha256_password_auto_generate_rsa_keys , and caching_sha2_password_auto_generate_rsa_keys  system variables control automatic generation of these files. These variables are enabled by default. They can be enabled at startup and inspected but not set at runtime. Automatic SSL and RSA File Generation Important 6.3.3.1 Creating SSL and RSA Certificates and Keys using MySQL Server autogeneration and  mysql_ssl_rsa_setup  help lower the barrier to using SSL by making it easier to generate the required files. However, certificates generated by these methods are self-signed, which may not be very secure. After you gain experience using such files, consider obtaining certificate/key material from a registered certificate authority. 6.3.3 Creating SSL and RSA Certificates and Keys