<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="creating-rsa-files-using-openssl">
      </a>
      8.3.3.3 Creating RSA Keys Using openssl
     </h4>
    </div>
   </div>
  </div>
  <p>
   This section describes how to use the
   <span class="command">
    <strong>
     openssl
    </strong>
   </span>
   command to set up the RSA key files that enable MySQL to support
        secure password exchange over unencrypted connections for
        accounts authenticated by the
   <code class="literal">
    sha256_password
   </code>
   (deprecated) and
   <code class="literal">
    caching_sha2_password
   </code>
   plugins.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    An easier alternative to generating the files required for SSL
          than the procedure described here is to let the server
          autogenerate them; see
    <a class="xref" href="creating-ssl-rsa-files-using-mysql.html" title="8.3.3.1 Creating SSL and RSA Certificates and Keys using MySQL">
     Section 8.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL”
    </a>
    .
   </p>
  </div>
  <p>
   To create the RSA private and public key-pair files, run these
        commands while logged into the system account used to run the
        MySQL server so that the files are owned by that account:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa31773720"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">openssl genrsa <span class="token property">-out</span> private_key<span class="token punctuation">.</span>pem 2048
openssl rsa <span class="token property">-in</span> private_key<span class="token punctuation">.</span>pem <span class="token property">-pubout</span> <span class="token property">-out</span> public_key<span class="token punctuation">.</span>pem</code></pre>
  </div>
  <p>
   Those commands create 2,048-bit keys. To create stronger keys,
        use a larger value.
  </p>
  <p>
   Then set the access modes for the key files. The private key
        should be readable only by the server, whereas the public key
        can be freely distributed to client users:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa80683155"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">chmod 400 private_key<span class="token punctuation">.</span>pem
chmod 444 public_key<span class="token punctuation">.</span>pem</code></pre>
  </div>
 </div>
 <br/>
</div>
