Account Management Statements • SUBJECT ’ subject ’ ALTER USER Resource-Limit Options ALTER USER ’jeffrey’@’localhost’ REQUIRE SUBJECT ’/C=SE/ST=Stockholm/L=Stockholm/ O=MySQL demo client certificate/ CN=client/emailAddress=client@example.com’ AND ISSUER ’/C=SE/ST=Stockholm/L=Stockholm/ O=MySQL/CN=CA/emailAddress=ca@example.com’ AND CIPHER ’EDH-RSA-DES-CBC3-SHA’; ALTER USER ’jeffrey’@’localhost’ REQUIRE SUBJECT ’/C=SE/ST=Stockholm/L=Stockholm/ O=MySQL demo client certificate/ CN=client/emailAddress=client@example.com’; • CIPHER ’ cipher ’ • MAX_USER_CONNECTIONS  count • MAX_QUERIES_PER_HOUR  count ,  MAX_UPDATES_PER_HOUR  count , MAX_CONNECTIONS_PER_HOUR  count 2845 For all accounts named by the statement, restricts the maximum number of simultaneous connections to the server by each account. A nonzero  count  specifies the limit for the account explicitly. If  count ALTER USER  permits these  resource_option  values: For all accounts named by the statement, these options restrict how many queries, updates, and connections to the server are permitted to each account during any given one-hour period. If  count  is  0 (the default), this means that there is no limitation for the account. Order of  WITH  options does not matter, except that if a given resource limit is specified multiple times, the last instance takes precedence. It is possible to place limits on use of server resources by an account, as discussed in Section 6.2.20, “Setting Account Resource Limits” . To do so, use a  WITH  clause that specifies one or more resource_option  values. MySQL does a simple string comparison of the  ’ subject ’  value to the value in the certificate, so lettercase and component ordering must be given exactly as present in the certificate. For all accounts named by the statement, requires that clients present a valid X.509 certificate containing the subject  subject . If a client presents a certificate that is valid but has a different subject, the server rejects the connection. Use of X.509 certificates always implies encryption, so the  SSL  option is unnecessary in this case. Because  SUBJECT  implies the requirements of  X509 , clients must specify the  --ssl-key  and  --ssl- cert  options to connect. (It is recommended but not required that  --ssl-ca  also be specified so that the public certificate provided by the server can be verified.) For all accounts named by the statement, requires a specific cipher method for encrypting connections. This option is needed to ensure that ciphers and key lengths of sufficient strength are used. Encryption can be weak if old algorithms using short encryption keys are used. ALTER USER ’jeffrey’@’localhost’ REQUIRE CIPHER ’EDH-RSA-DES-CBC3-SHA’; The  SUBJECT ,  ISSUER , and  CIPHER  options can be combined in the  REQUIRE  clause: