<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="sha256-pluggable-authentication">
      </a>
      8.4.1.3 SHA-256 Pluggable Authentication
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045246106400">
  </a>
  <a class="indexterm" name="idm46045246105312">
  </a>
  <p>
   MySQL provides two authentication plugins that implement SHA-256
        hashing for user account passwords:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <code class="literal">
       caching_sha2_password
      </code>
      : Implements SHA-256
            authentication (like
      <code class="literal">
       sha256_password
      </code>
      ),
            but uses caching on the server side for better performance
            and has additional features for wider applicability.
     </p>
    </li>
    <li class="listitem">
     <p>
      <code class="literal">
       sha256_password
      </code>
      (deprecated): Implements
            basic SHA-256 authentication.
     </p>
    </li>
   </ul>
  </div>
  <p>
   This section describes the original noncaching SHA-2
        authentication plugin. For information about the caching plugin,
        see
   <a class="xref" href="caching-sha2-pluggable-authentication.html" title="8.4.1.2 Caching SHA-2 Pluggable Authentication">
    Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”
   </a>
   .
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    In MySQL 8.4,
    <code class="literal">
     caching_sha2_password
    </code>
    is the default
          authentication plugin rather than
    <code class="literal">
     mysql_native_password
    </code>
    (deprecated). For
          information about the implications of this change for server
          operation and compatibility of the server with clients and
          connectors, see
    <a class="ulink" href="/doc/refman/8.0/en/upgrading-from-previous-series.html#upgrade-caching-sha2-password" target="_top">
     caching_sha2_password as the Preferred Authentication Plugin
    </a>
    .
   </p>
   <p>
    Because
    <code class="literal">
     caching_sha2_password
    </code>
    is the
          default authentication plugin in MySQL 8.4 and
          provides a superset of the capabilities of the
    <code class="literal">
     sha256_password
    </code>
    authentication plugin,
    <code class="literal">
     sha256_password
    </code>
    is deprecated; expect it to
          be removed in a future version of MySQL. MySQL accounts that
          authenticate using
    <code class="literal">
     sha256_password
    </code>
    should
          be migrated to use
    <code class="literal">
     caching_sha2_password
    </code>
    instead.
   </p>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    To connect to the server using an account that authenticates
          with the
    <code class="literal">
     sha256_password
    </code>
    plugin, you must
          use either a TLS connection or an unencrypted connection that
          supports password exchange using an RSA key pair, as described
          later in this section. Either way, the
    <code class="literal">
     sha256_password
    </code>
    plugin uses MySQL's
          encryption capabilities. See
    <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
     Section 8.3, “Using Encrypted Connections”
    </a>
    .
   </p>
  </div>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    In the name
    <code class="literal">
     sha256_password
    </code>
    ,
    <span class="quote">
     “
     <span class="quote">
      sha256
     </span>
     ”
    </span>
    refers to the 256-bit digest length the
          plugin uses for encryption. In the name
    <code class="literal">
     caching_sha2_password
    </code>
    ,
    <span class="quote">
     “
     <span class="quote">
      sha2
     </span>
     ”
    </span>
    refers more generally to the SHA-2 class of encryption
          algorithms, of which 256-bit encryption is one instance. The
          latter name choice leaves room for future expansion of
          possible digest lengths without changing the plugin name.
   </p>
  </div>
  <p>
   The following table shows the plugin names on the server and
        client sides.
  </p>
  <div class="table">
   <a name="idm46045246082928">
   </a>
   <p class="title">
    <b>
     Table 8.16 Plugin and Library Names for SHA-256 Authentication
    </b>
   </p>
   <div class="table-contents">
    <table summary="Names for the plugins and library file used for SHA-256 password authentication.">
     <colgroup>
      <col style="width: 30%"/>
      <col style="width: 70%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Plugin or File
       </th>
       <th>
        Plugin or File Name
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        Server-side plugin
       </td>
       <td>
        <code class="literal">
         sha256_password
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Client-side plugin
       </td>
       <td>
        <code class="literal">
         sha256_password
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Library file
       </td>
       <td>
        None (plugins are built in)
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <p>
   The following sections provide installation and usage
        information specific to SHA-256 pluggable authentication:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="sha256-pluggable-authentication.html#sha256-pluggable-authentication-installation" title="Installing SHA-256 Pluggable Authentication">
       Installing SHA-256 Pluggable Authentication
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="sha256-pluggable-authentication.html#sha256-pluggable-authentication-usage" title="Using SHA-256 Pluggable Authentication">
       Using SHA-256 Pluggable Authentication
      </a>
     </p>
    </li>
   </ul>
  </div>
  <p>
   For general information about pluggable authentication in MySQL,
        see
   <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
    Section 8.2.17, “Pluggable Authentication”
   </a>
   .
  </p>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="sha256-pluggable-authentication-installation">
       </a>
       Installing SHA-256 Pluggable Authentication
      </h5>
     </div>
    </div>
   </div>
   <p>
    The
    <code class="literal">
     sha256_password
    </code>
    (deprecated) plugin
          exists in server and client forms:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The server-side plugin is built into the server, need not
              be loaded explicitly, and cannot be disabled by unloading
              it.
      </p>
     </li>
     <li class="listitem">
      <p>
       The client-side plugin is built into the
       <code class="literal">
        libmysqlclient
       </code>
       client library and is
              available to any program linked against
       <code class="literal">
        libmysqlclient
       </code>
       .
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="sha256-pluggable-authentication-usage">
       </a>
       Using SHA-256 Pluggable Authentication
      </h5>
     </div>
    </div>
   </div>
   <p>
    To set up an account that uses the deprecated
    <code class="literal">
     sha256_password
    </code>
    plugin for SHA-256 password
          hashing, use the following statement, where
    <em class="replaceable">
     <code>
      password
     </code>
    </em>
    is the desired account
          password:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa78068234"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'sha256user'</span>@<span class="token string">'localhost'</span>
<span class="token keyword">IDENTIFIED</span> <span class="token keyword">WITH</span> sha256_password <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The server assigns the
    <code class="literal">
     sha256_password
    </code>
    plugin to the account and uses it to encrypt the password
          using SHA-256, storing those values in the
    <code class="literal">
     plugin
    </code>
    and
    <code class="literal">
     authentication_string
    </code>
    columns of the
    <code class="literal">
     mysql.user
    </code>
    system table.
   </p>
   <p>
    (The
    <code class="literal">
     IDENTIFIED WITH
    </code>
    clause is not needed
          if
    <code class="literal">
     sha256_password
    </code>
    is the default plugin;
          this can be specified using
    <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
     <code class="literal">
      authentication_policy
     </code>
    </a>
    .)
   </p>
   <p>
    <code class="literal">
     sha256_password
    </code>
    supports connections over
          secure transport.
    <code class="literal">
     sha256_password
    </code>
    also
          supports encrypted password exchange using RSA over
          unencrypted connections if MySQL is compiled using OpenSSL,
          and the MySQL server to which you wish to connect is
          configured to support RSA (using the RSA configuration
          procedure given later in this section).
   </p>
   <p>
    RSA support has these characteristics:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       On the server side, two system variables name the RSA
              private and public key-pair files:
       <a class="link" href="server-system-variables.html#sysvar_sha256_password_private_key_path">
        <code class="literal">
         sha256_password_private_key_path
        </code>
       </a>
       and
       <a class="link" href="server-system-variables.html#sysvar_sha256_password_public_key_path">
        <code class="literal">
         sha256_password_public_key_path
        </code>
       </a>
       .
              The database administrator must set these variables at
              server startup if the key files to use have names that
              differ from the system variable default values.
      </p>
     </li>
     <li class="listitem">
      <p>
       The server uses the
       <a class="link" href="server-system-variables.html#sysvar_sha256_password_auto_generate_rsa_keys">
        <code class="literal">
         sha256_password_auto_generate_rsa_keys
        </code>
       </a>
       system variable to determine whether to automatically
              generate the RSA key-pair files. See
       <a class="xref" href="creating-ssl-rsa-files.html" title="8.3.3 Creating SSL and RSA Certificates and Keys">
        Section 8.3.3, “Creating SSL and RSA Certificates and Keys”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <a class="link" href="server-status-variables.html#statvar_Rsa_public_key">
        <code class="literal">
         Rsa_public_key
        </code>
       </a>
       status variable displays the RSA public key value used by
              the
       <code class="literal">
        sha256_password
       </code>
       authentication
              plugin.
      </p>
     </li>
     <li class="listitem">
      <p>
       Clients that are in possession of the RSA public key can
              perform RSA key pair-based password exchange with the
              server during the connection process, as described later.
      </p>
     </li>
     <li class="listitem">
      <p>
       For connections by accounts that authenticate with
       <code class="literal">
        sha256_password
       </code>
       and RSA public key
              pair-based password exchange, the server sends the RSA
              public key to the client as needed. However, if a copy of
              the public key is available on the client host, the client
              can use it to save a round trip in the client/server
              protocol:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          For these command-line clients, use the
          <a class="link" href="mysql-command-options.html#option_mysql_server-public-key-path">
           <code class="option">
            --server-public-key-path
           </code>
          </a>
          option to specify the RSA public key file:
          <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
           <span class="command">
            <strong>
             mysql
            </strong>
           </span>
          </a>
          ,
          <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
           <span class="command">
            <strong>
             mysqladmin
            </strong>
           </span>
          </a>
          ,
          <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
           <span class="command">
            <strong>
             mysqlbinlog
            </strong>
           </span>
          </a>
          ,
          <a class="link" href="mysqlcheck.html" title="6.5.3 mysqlcheck — A Table Maintenance Program">
           <span class="command">
            <strong>
             mysqlcheck
            </strong>
           </span>
          </a>
          ,
          <a class="link" href="mysqldump.html" title="6.5.4 mysqldump — A Database Backup Program">
           <span class="command">
            <strong>
             mysqldump
            </strong>
           </span>
          </a>
          ,
          <a class="link" href="mysqlimport.html" title="6.5.5 mysqlimport — A Data Import Program">
           <span class="command">
            <strong>
             mysqlimport
            </strong>
           </span>
          </a>
          ,
          <a class="link" href="mysqlshow.html" title="6.5.6 mysqlshow — Display Database, Table, and Column Information">
           <span class="command">
            <strong>
             mysqlshow
            </strong>
           </span>
          </a>
          ,
          <a class="link" href="mysqlslap.html" title="6.5.7 mysqlslap — A Load Emulation Client">
           <span class="command">
            <strong>
             mysqlslap
            </strong>
           </span>
          </a>
          ,
          <span class="command">
           <strong>
            mysqltest
           </strong>
          </span>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          For programs that use the C API, call
          <a class="ulink" href="/doc/c-api/8.4/en/mysql-options.html" target="_top">
           <code class="literal">
            mysql_options()
           </code>
          </a>
          to
                  specify the RSA public key file by passing the
          <code class="literal">
           MYSQL_SERVER_PUBLIC_KEY
          </code>
          option and
                  the name of the file.
         </p>
        </li>
        <li class="listitem">
         <p>
          For replicas, use the
          <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
           <code class="literal">
            CHANGE
                  REPLICATION SOURCE TO
           </code>
          </a>
          statement with the
          <code class="literal">
           SOURCE_PUBLIC_KEY_PATH
          </code>
          option to
                  specify the RSA public key file. For Group
                  Replication, the
          <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_get_public_key">
           <code class="literal">
            group_replication_recovery_get_public_key
           </code>
          </a>
          system variable serves the same purpose.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
   <p>
    For clients that use the
    <code class="literal">
     sha256_password
    </code>
    plugin, passwords are never exposed as cleartext when
          connecting to the server. How password transmission occurs
          depends on whether a secure connection or RSA encryption is
          used:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       If the connection is secure, an RSA key pair is
              unnecessary and is not used. This applies to connections
              encrypted using TLS. The password is sent as cleartext but
              cannot be snooped because the connection is secure.
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        Unlike
        <code class="literal">
         caching_sha2_password
        </code>
        , the
                deprecated
        <code class="literal">
         sha256_password
        </code>
        plugin
                does not treat shared-memory connections as secure, even
                though share-memory transport is secure by default.
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       If the connection is not secure, and an RSA key pair is
              available, the connection remains unencrypted. This
              applies to connections not encrypted using TLS. RSA is
              used only for password exchange between client and server,
              to prevent password snooping. When the server receives the
              encrypted password, it decrypts it. A scramble is used in
              the encryption to prevent repeat attacks.
      </p>
     </li>
     <li class="listitem">
      <p>
       If a secure connection is not used and RSA encryption is
              not available, the connection attempt fails because the
              password cannot be sent without being exposed as
              cleartext.
      </p>
     </li>
    </ul>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     To use RSA password encryption with the deprecated
     <code class="literal">
      sha256_password
     </code>
     plugin, the client and
            server both must be compiled using OpenSSL, not just one of
            them.
    </p>
   </div>
   <p>
    Assuming that MySQL has been compiled using OpenSSL, use the
          following procedure to enable use of an RSA key pair for
          password exchange during the client connection process:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Create the RSA private and public key-pair files using the
              instructions in
       <a class="xref" href="creating-ssl-rsa-files.html" title="8.3.3 Creating SSL and RSA Certificates and Keys">
        Section 8.3.3, “Creating SSL and RSA Certificates and Keys”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       If the private and public key files are located in the
              data directory and are named
       <code class="filename">
        private_key.pem
       </code>
       and
       <code class="filename">
        public_key.pem
       </code>
       (the default values of
              the
       <a class="link" href="server-system-variables.html#sysvar_sha256_password_private_key_path">
        <code class="literal">
         sha256_password_private_key_path
        </code>
       </a>
       and
       <a class="link" href="server-system-variables.html#sysvar_sha256_password_public_key_path">
        <code class="literal">
         sha256_password_public_key_path
        </code>
       </a>
       system variables), the server uses them automatically at
              startup.
      </p>
      <p>
       Otherwise, to name the key files explicitly, set the
              system variables to the key file names in the server
              option file. If the files are located in the server data
              directory, you need not specify their full path names:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa35561967"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">sha256_password_private_key_path</span><span class="token attr-value"><span class="token punctuation">=</span>myprivkey.pem</span>
<span class="token constant">sha256_password_public_key_path</span><span class="token attr-value"><span class="token punctuation">=</span>mypubkey.pem</span></code></pre>
      </div>
      <p>
       If the key files are not located in the data directory, or
              to make their locations explicit in the system variable
              values, use full path names:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa79683714"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">sha256_password_private_key_path</span><span class="token attr-value"><span class="token punctuation">=</span>/usr/local/mysql/myprivkey.pem</span>
<span class="token constant">sha256_password_public_key_path</span><span class="token attr-value"><span class="token punctuation">=</span>/usr/local/mysql/mypubkey.pem</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Restart the server, then connect to it and check the
       <a class="link" href="server-status-variables.html#statvar_Rsa_public_key">
        <code class="literal">
         Rsa_public_key
        </code>
       </a>
       status
              variable value. The value actually displayed differs from
              that shown here, but should be nonempty:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa76691024"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SHOW</span> <span class="token keyword">STATUS</span> <span class="token operator">LIKE</span> <span class="token string">'Rsa_public_key'</span>\G
<span class="token output"><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span> 1. row <span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span><span class="token punctuation">*</span>
Variable_name<span class="token punctuation">:</span> Rsa_public_key
        Value<span class="token punctuation">:</span> -----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDO9nRUDd+KvSZgY7cNBZMNpwX6
MvE1PbJFXO7u18nJ9lwc99Du/E7lw6CVXw7VKrXPeHbVQUzGyUNkf45Nz/ckaaJa
aLgJOBCIDmNVnyU54OT/1lcs2xiyfaDMe8fCJ64ZwTnKbY2gkt1IMjUAB5Ogd5kJ
g8aV7EtKwyhHb0c30QIDAQAB
-----END PUBLIC KEY-----</span></code></pre>
      </div>
      <p>
       If the value is empty, the server found some problem with
              the key files. Check the error log for diagnostic
              information.
      </p>
     </li>
    </ol>
   </div>
   <p>
    After the server has been configured with the RSA key files,
          accounts that authenticate with the deprecated
    <code class="literal">
     sha256_password
    </code>
    plugin have the option of
          using those key files to connect to the server. As mentioned
          previously, such accounts can use either a secure connection
          (in which case RSA is not used) or an unencrypted connection
          that performs password exchange using RSA. Suppose that an
          unencrypted connection is used. For example:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa33790152"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--ssl-mode</span><span class="token attr-value"><span class="token punctuation">=</span>DISABLED</span> <span class="token property">-u</span> sha256user <span class="token property">-p</span>
Enter password<span class="token punctuation">:</span> <em class="replaceable">password</em></code></pre>
   </div>
   <p>
    For this connection attempt by
    <code class="literal">
     sha256user
    </code>
    ,
          the server determines that
    <code class="literal">
     sha256_password
    </code>
    is the appropriate authentication plugin and invokes it
          (because that was the plugin specified at
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    time). The plugin
          finds that the connection is not encrypted and thus requires
          the password to be transmitted using RSA encryption. In this
          case, the plugin sends the RSA public key to the client, which
          uses it to encrypt the password and returns the result to the
          server. The plugin uses the RSA private key on the server side
          to decrypt the password and accepts or rejects the connection
          based on whether the password is correct.
   </p>
   <p>
    The server sends the RSA public key to the client as needed.
          However, if the client has a file containing a local copy of
          the RSA public key required by the server, it can specify the
          file using the
    <a class="link" href="mysql-command-options.html#option_mysql_server-public-key-path">
     <code class="option">
      --server-public-key-path
     </code>
    </a>
    option:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa36750553"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--ssl-mode</span><span class="token attr-value"><span class="token punctuation">=</span>DISABLED</span> <span class="token property">-u</span> sha256user <span class="token property">-p</span> <span class="token constant">--server-public-key-path</span><span class="token attr-value"><span class="token punctuation">=</span><em class="replaceable">file_name</em></span>
Enter password<span class="token punctuation">:</span> <em class="replaceable">password</em></code></pre>
   </div>
   <p>
    The public key value in the file named by the
    <a class="link" href="mysql-command-options.html#option_mysql_server-public-key-path">
     <code class="option">
      --server-public-key-path
     </code>
    </a>
    option
          should be the same as the key value in the server-side file
          named by the
    <a class="link" href="server-system-variables.html#sysvar_sha256_password_public_key_path">
     <code class="literal">
      sha256_password_public_key_path
     </code>
    </a>
    system variable. If the key file contains a valid public key
          value but the value is incorrect, an access-denied error
          occurs. If the key file does not contain a valid public key,
          the client program cannot use it. In this case, the deprecated
    <code class="literal">
     sha256_password
    </code>
    plugin sends the public key
          to the client as if no
    <a class="link" href="mysql-command-options.html#option_mysql_server-public-key-path">
     <code class="option">
      --server-public-key-path
     </code>
    </a>
    option
          had been specified.
   </p>
   <p>
    Client users can obtain the RSA public key two ways:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The database administrator can provide a copy of the
              public key file.
      </p>
     </li>
     <li class="listitem">
      <p>
       A client user who can connect to the server some other way
              can use a
       <code class="literal">
        SHOW STATUS LIKE
              'Rsa_public_key'
       </code>
       statement and save the returned
              key value in a file.
      </p>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
