Creating SSL and RSA Certificates and Keys At startup, the server automatically generates server-side and client-side SSL certificate and key files in the data directory if the  auto_generate_certs  system variable is enabled, no SSL options other than  --ssl  are specified, and the server-side SSL files are missing from the data directory. These files enable encrypted client connections using SSL; see Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . 1. The server checks the data directory for SSL files with the following names: 2. If any of those files are present, the server creates no SSL files. Otherwise, it creates them, plus some additional files: 3. If the server autogenerates SSL files, it uses the names of the  ca.pem ,  server-cert.pem , and server-key.pem  files to set the corresponding system variables ( ssl_ca ,  ssl_cert ,  ssl_key ). 1. The server checks the data directory for RSA files with the following names: 2. If any of these files are present, the server creates no RSA files. Otherwise, it creates them. 3. If the server autogenerates the RSA files, it uses their names to set the corresponding system variables ( sha256_password_private_key_path  and sha256_password_public_key_path ;  caching_sha2_password_private_key_path  and caching_sha2_password_public_key_path ). •SSL and RSA keys are have a size of 2048 bits. ca.pem server-cert.pem server-key.pem ca.pem Self-signed CA certificate ca-key.pem CA private key server-cert.pem Server certificate server-key.pem Server private key client-cert.pem Client certificate client-key.pem Client private key private_key.pem Private member of private/public key pair public_key.pem Public member of private/public key pair At startup, the server automatically generates RSA private/public key-pair files in the data directory if all of these conditions are true: The  sha256_password_auto_generate_rsa_keys  or caching_sha2_password_auto_generate_rsa_keys  system variable is enabled; no RSA options are specified; the RSA files are missing from the data directory. These key-pair files enable secure password exchange using RSA over unencrypted connections for accounts authenticated by the sha256_password  or  caching_sha2_password  plugin; see Section 6.4.1.3, “SHA-256 Pluggable Authentication” , and Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication” . MySQL distributions include a  mysql_ssl_rsa_setup  utility that can be invoked manually to generate SSL and RSA files. This utility is included with all MySQL distributions, but it does require that the openssl  command be available. For usage instructions, see Section 4.4.3, “mysql_ssl_rsa_setup — Create SSL/RSA Files” . SSL and RSA files created automatically by the server or by invoking  mysql_ssl_rsa_setup  have these characteristics: Manual SSL and RSA File Generation Using mysql_ssl_rsa_setup SSL and RSA File Characteristics 1297