The MySQL Keyring The Key Management Interoperability Protocol (KMIP) enables communication of cryptographic keys between a key management server and its clients. The  keyring_okv  keyring plugin uses the KMIP 1.1 protocol to communicate securely as a client of a KMIP back end. Keyring material is generated exclusively by the back end, not by  keyring_okv . The plugin works with these KMIP-compatible products: The  keyring_okv  plugin supports the functions that comprise the standard MySQL Keyring service interface. Keyring operations performed by those functions are accessible at two levels: Example (using the SQL interface): •Oracle Key Vault •Gemalto SafeNet KeySecure Appliance •Townsend Alliance Key Manager •SQL interface: In SQL statements, call the functions described in Section 6.4.4.14, “General-Purpose Keyring Key-Management Functions” . •C interface: In C-language code, call the keyring service functions described in Section 5.6.9.2, “The Keyring Service” . •General keyring_okv Configuration •Configuring keyring_okv for Oracle Key Vault •Configuring keyring_okv for Gemalto SafeNet KeySecure Appliance •Configuring keyring_okv for Townsend Alliance Key Manager •Password-Protecting the keyring_okv Key File • okvclient.ora : A file that contains details of the KMIP back end with which  keyring_okv communicates. • ssl : A directory that contains the certificate and key files required to establish a secure connection with the KMIP back end:  CA.pem ,  cert.pem , and  key.pem . If the key file is password-protected, the  ssl 1411 The  keyring_okv_conf_dir  variable must name a directory that contains the following items: Regardless of which KMIP back end the  keyring_okv  plugin uses for keyring storage, the keyring_okv_conf_dir  system variable configures the location of the directory used by  keyring_okv for its support files. The default value is empty, so you must set the variable to name a properly configured directory before the plugin can communicate with the KMIP back end. Unless you do so,  keyring_okv writes a message to the error log during server startup that it cannot communicate: General keyring_okv Configuration [Warning] Plugin keyring_okv reported: ’For keyring_okv to be initialized, please point the keyring_okv_conf_dir variable to a directory containing Oracle Key Vault configuration file and ssl materials’ SELECT keyring_key_generate(’MyKey’, ’AES’, 32); SELECT keyring_key_remove(’MyKey’); To install  keyring_okv , use the general instructions found in Section 6.4.4.3, “Keyring Plugin Installation” , together with the configuration information specific to  keyring_okv  found here. For information about the characteristics of key values permitted by  keyring_okv , Section 6.4.4.12, “Supported Keyring Key Types and Lengths” .