Command Options for Connecting to the Server accounts that do not authenticate with one of those plugins. It is also ignored if RSA-based password exchange is not used, as is the case when the client connects to the server using a secure connection. If  --server-public-key-path= file_name  is given and specifies a valid public key file, it takes precedence over  --get-server-public-key . This option is available only if MySQL was built using OpenSSL. For information about the  sha256_password  and  caching_sha2_password  plugins, see Section 6.4.1.3, “SHA-256 Pluggable Authentication” , and Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication” . The path name of the Certificate Authority (CA) certificate file in PEM format. The file contains a list of trusted SSL Certificate Authorities. To tell the client not to authenticate the server certificate when establishing an encrypted connection to the server, specify neither  --ssl-ca  nor  --ssl-capath . The server still verifies the client according to any applicable requirements established for the client account, and it still uses any  ssl_ca  or ssl_capath  system variable values specified on the server side. To specify the CA file for the server, set the  ssl_ca  system variable. The path name of the directory that contains trusted SSL certificate authority (CA) certificate files in PEM format. To tell the client not to authenticate the server certificate when establishing an encrypted connection to the server, specify neither  --ssl-ca  nor  --ssl-capath . The server still verifies the client according to any applicable requirements established for the client account, and it still uses any  ssl_ca  or ssl_capath  system variable values specified on the server side. To specify the CA directory for the server, set the  ssl_capath  system variable. The path name of the client SSL public key certificate file in PEM format. To specify the server SSL public key certificate file, set the  ssl_cert  system variable. The list of permissible encryption ciphers for connections that use TLS protocols up through TLSv1.2. If no cipher in the list is supported, encrypted connections that use these TLS protocols do not work. For greatest portability,  cipher_list  should be a list of one or more cipher names, separated by colons. Examples: OpenSSL supports the syntax for specifying ciphers described in the OpenSSL documentation at https:// www.openssl.org/docs/manmaster/man1/ciphers.html. --ssl-cipher=AES128-SHA --ssl-cipher=DHE-RSA-AES128-GCM-SHA256:AES128-SHA For information about which encryption ciphers MySQL supports, see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . 360 • --ssl-cipher= cipher_list • --ssl-cert= file_name • --ssl-capath= dir_name • --ssl-ca= file_name