Authentication Plugins transmitted using RSA encryption. However, the server does not send the public key to the client, and the client provided no public key, so it cannot encrypt the password and the connection fails: To request the RSA public key from the server, specify the  --get-server-public-key  option: In this case, the server sends the RSA public key to the client, which uses it to encrypt the password and returns the result to the server. The plugin uses the RSA private key on the server side to decrypt the password and accepts or rejects the connection based on whether the password is correct. Alternatively, if the client has a file containing a local copy of the RSA public key required by the server, it can specify the file using the  --server-public-key-path  option: In this case, the client uses the public key to encrypt the password and returns the result to the server. The plugin uses the RSA private key on the server side to decrypt the password and accepts or rejects the connection based on whether the password is correct. The public key value in the file named by the  --server-public-key-path  option should be the same as the key value in the server-side file named by the  caching_sha2_password_public_key_path system variable. If the key file contains a valid public key value but the value is incorrect, an access-denied error occurs. If the key file does not contain a valid public key, the client program cannot use it. Client users can obtain the RSA public key two ways: On the server side, the  caching_sha2_password  plugin uses an in-memory cache for faster authentication of clients who have connected previously. Entries consist of account-name/password-hash pairs. The cache works like this: In this way, when a client first connects, authentication against the  mysql.user  system table occurs. When the client connects subsequently, faster authentication against the cache occurs. Password cache operations other than adding entries are handled by the  sha2_cache_cleaner  audit plugin, which performs these actions on behalf of  caching_sha2_password : 1311 •It clears the cache entry for any account that is renamed or dropped, or any account for which the credentials or authentication plugin are changed. •It empties the cache when the  FLUSH PRIVILEGES  statement is executed. 1. When a client connects,  caching_sha2_password  checks whether the client and password match some cache entry. If so, authentication succeeds. 2. If there is no matching cache entry, the plugin attempts to verify the client against the credentials in the mysql.user  system table. If this succeeds,  caching_sha2_password  adds an entry for the client to the hash. Otherwise, authentication fails and the connection is rejected. •A client user who can connect to the server some other way can use a  SHOW STATUS LIKE ’Caching_sha2_password_rsa_public_key’  statement and save the returned key value in a file. •The database administrator can provide a copy of the public key file. Cache Operation for SHA-2 Pluggable Authentication ERROR 2061 (HY000): Authentication plugin ’caching_sha2_password’ reported error: Authentication requires secure connection. shell>  mysql --ssl-mode=DISABLED -u sha2user -p --get-server-public-key Enter password:  password shell>  mysql --ssl-mode=DISABLED -u sha2user -p --server-public-key-path= file_name Enter password:  password