Using X Plugin with the Caching SHA-2 Authentication Plugin [mysqld] ssl_ca=ca.pem ssl_cert=server-cert.pem ssl_key=server-key.pem To configure encryption separately for MySQL Protocol and X Protocol connections, set both the  ssl_ xxx and  mysqlx_ssl_ xxx  system variables in  my.cnf : [mysqld] ssl_ca=ca1.pem ssl_cert=server-cert1.pem ssl_key=server-key1.pem mysqlx_ssl_ca=ca2.pem mysqlx_ssl_cert=server-cert2.pem mysqlx_ssl_key=server-key2.pem For general information about configuring connection-encryption support, see Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . That discussion is written for MySQL Server, but the parameter names are similar for X Plugin. (The X Plugin  mysqlx_ssl_ xxx  system variable names correspond to the MySQL Server  ssl_ xxx  system variable names.) The  tls_version  system variable that determines the permitted TLS versions for MySQL Protocol connections also applies to X Protocol connections. The permitted TLS versions for both types of connections are therefore the same. Encryption per connection is optional, but a specific user can be required to use encryption for X Protocol and MySQL Protocol connections by including an appropriate  REQUIRE  clause in the  CREATE USER  statement that creates the user. For details, see Section 13.7.1.3, “CREATE USER Statement” . Alternatively, to require all users to use encryption for X Protocol and MySQL Protocol connections, enable the  require_secure_transport  system variable. For additional information, see Configuring Encrypted Connections as Mandatory. 20.5.4 Using X Plugin with the Caching SHA-2 Authentication Plugin X Plugin supports MySQL user accounts created with the  caching_sha2_password  authentication plugin. For more information on this plugin, see Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication” . You can use X Plugin to authenticate against such accounts using non-SSL connections with  SHA256_MEMORY  authentication and SSL connections with  PLAIN  authentication. Although the  caching_sha2_password  authentication plugin holds an authentication cache, this cache is not shared with X Plugin, so X Plugin uses its own authentication cache for  SHA256_MEMORY authentication. The X Plugin authentication cache stores hashes of user account passwords, and cannot be accessed using SQL. If a user account is modified or removed, the relevant entries are removed from the cache. The X Plugin authentication cache is maintained by the  mysqlx_cache_cleaner  plugin, which is enabled by default, and has no related system variables or status variables. Before you can use non-SSL X Protocol connections to authenticate an account that uses the caching_sha2_password  authentication plugin, the account must have authenticated at least once over an X Protocol connection with SSL, to supply the password to the X Plugin authentication cache. Once this initial authentication over SSL has succeeded, non-SSL X Protocol connections can be used. It is possible to disable the  mysqlx_cache_cleaner  plugin by starting the MySQL server with the option  --mysqlx_cache_cleaner=0 . If you do this, the X Plugin authentication cache is disabled, and therefore SSL must always be used for X Protocol connections when authenticating with  SHA256_MEMORY authentication. 20.5.5 Connection Compression with X Plugin 3887