Authentication Plugins Note Unlike  caching_sha2_password , the  sha256_password  plugin does not treat shared-memory connections as secure, even though share-memory transport is secure by default. •If the connection is not secure, and an RSA key pair is available, the connection remains unencrypted. This applies to connections not encrypted using TLS. RSA is used only for password exchange between client and server, to prevent password snooping. When the server receives the encrypted password, it decrypts it. A scramble is used in the encryption to prevent repeat attacks. •If a secure connection is not used and RSA encryption is not available, the connection attempt fails because the password cannot be sent without being exposed as cleartext. Note To use RSA password encryption with  sha256_password , the client and server both must be compiled using OpenSSL, not just one of them. Assuming that MySQL has been compiled using OpenSSL, use the following procedure to enable use of an RSA key pair for password exchange during the client connection process: Otherwise, to name the key files explicitly, set the system variables to the key file names in the server option file. If the files are located in the server data directory, you need not specify their full path names: 1. Create the RSA private and public key-pair files using the instructions in Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . 2. If the private and public key files are located in the data directory and are named  private_key.pem and  public_key.pem  (the default values of the  sha256_password_private_key_path  and sha256_password_public_key_path  system variables), the server uses them automatically at startup. 3. Restart the server, then connect to it and check the  Rsa_public_key  status variable value. The value actually displayed differs from that shown here, but should be nonempty: If the key files are not located in the data directory, or to make their locations explicit in the system variable values, use full path names: [mysqld] sha256_password_private_key_path=myprivkey.pem sha256_password_public_key_path=mypubkey.pem [mysqld] sha256_password_private_key_path=/usr/local/mysql/myprivkey.pem sha256_password_public_key_path=/usr/local/mysql/mypubkey.pem mysql>  SHOW STATUS LIKE ’Rsa_public_key’\G *************************** 1. row *************************** Variable_name: Rsa_public_key Value: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDO9nRUDd+KvSZgY7cNBZMNpwX6 MvE1PbJFXO7u18nJ9lwc99Du/E7lw6CVXw7VKrXPeHbVQUzGyUNkf45Nz/ckaaJa aLgJOBCIDmNVnyU54OT/1lcs2xiyfaDMe8fCJ64ZwTnKbY2gkt1IMjUAB5Ogd5kJ g8aV7EtKwyhHb0c30QIDAQAB -----END PUBLIC KEY----- If the value is empty, the server found some problem with the key files. Check the error log for diagnostic information. 1315