The MySQL Keyring • --socket : For Unix socket file or Windows named pipe connections, the socket file or named pipe to connect to on the running server. For descriptions of all available options, see Section 4.6.8, “mysql_migrate_keyring — Keyring Key Migration Utility” . Start  mysql_migrate_keyring  with options indicating the source and destination keystores and whether the migration is offline or online, possibly with other options. Keep the following considerations in mind: If you invoke  mysql_migrate_keyring  from a system account different from that normally used to run MySQL, it might create keyring directories or files that are inaccessible to the server during normal operation. Suppose that  mysqld  normally runs as the  mysql  operating system user, but you invoke  mysql_migrate_keyring  while logged in as  isabel . Any new directories or files created by mysql_migrate_keyring  are owned by  isabel . Subsequent startup fails when a server run as the mysql  operating system user attempts to access file system objects owned by  isabel . To avoid this issue, invoke  mysql_migrate_keyring  as the  mysql  operating system user. Alternatively, after the migration, examine the keyring-related file system objects and change their ownership and permissions if necessary using  chown ,  chmod , or similar commands, so that the objects are accessible to the running server. Suppose that you want to migrate keys from  component_keyring_file  to component_keyring_encrypted_file , and that the local server stores its keyring component library files in  /usr/local/mysql/lib/plugin . If no running server is using the keyring, an offline migration is permitted. Invoke mysql_migrate_keyring  like this (enter the command on a single line): If a running server is using the keyring, you must perform an online migration instead. In this case, the  -- online-migration  option must be given, along with any connection options required to specify which server to connect to and the MySQL account to use. The following command performs an online migration. It connects to the local server using a TCP/IP connection and the  admin  account. The command prompts for a password, which you should enter when prompted: mysql_migrate_keyring  performs a migration operation as follows: 1436 1. (Online migration only) Connect to the running server using the connection options. 2. (Online migration only) Disable  keyring_operations  on the running server. 3. Load the keyring component libraries for the source and destination keystores. mysql_migrate_keyring --component-dir=/usr/local/mysql/lib/plugin --source-keyring=component_keyring_file --destination-keyring=component_keyring_encrypted_file --online-migration --host=127.0.0.1 --user=admin --password mysql_migrate_keyring --component-dir=/usr/local/mysql/lib/plugin --source-keyring=component_keyring_file --destination-keyring=component_keyring_encrypted_file •The user who invokes  mysql_migrate_keyring  must not be the  root  operating system user. •The user who invokes  mysql_migrate_keyring  must have permission to read and write any local keyring files, such as the data file for a file-based plugin.