The mysql_migrate_keyring utility migrates keys between one
keyring component and another. It supports offline and online
migrations.
Invoke mysql_migrate_keyring like this (enter the command
on a single line):
mysql_migrate_keyring
--component-dir=dir_name
--source-keyring=name
--destination-keyring=name
[other options]
For information about key migrations and instructions describing
how to perform them using mysql_migrate_keyring and other methods,
see Section 6.4.4.14, “Migrating Keys Between Keyring
Keystores”.
mysql_migrate_keyring supports the following options, which
can be specified on the command line or in the [mysql_migrate_keyring] group
of an option file. For information about option files used by MySQL
programs, see Section 4.2.2.2, “Using Option
Files”.
•--help, -h Display a help message
and exit.
•
--component-dir=dir_name The
directory where keyring components are located. This is typically the value of
the plugin_dir system variable for the local MySQL server.
Note
--component-dir,
--source-keyring, and
--destination-keyring are mandatory for all keyring migration
operations performed by
mysql_migrate_keyring. In addition, the source
and destination components must differ, and both components must be properly
configured so that
mysql_migrate_keyring can load and use them.
•
--defaults-extra-file=file_name
Read this option file after the global option file but (on Unix) before the
user option file. If the file does not exist or is otherwise inaccessible, an
error occurs. If
file_name is not an absolute path name, it is
interpreted relative to the current directory.
For additional information about this and other option-file
options, see Section 4.2.2.3, “Command-Line Options that
Affect Option-File Handling”.
•
--defaults-file=file_name
Use only the given option file. If the file does not exist or is otherwise
inaccessible, an error occurs. If
file_name is not an absolute path
name, it is interpreted relative to the current directory.
Exception: Even with --defaults-file, client programs read
.mylogin.cnf.
For additional information about this and other option-file
options, see Section 4.2.2.3, “Command-Line Options that
Affect Option-File Handling”.
•
--defaults-group-suffix=str
Read not only the usual option groups, but also groups with the usual names
and a suffix of
str. For example,
mysql_migrate_keyring normally
reads the [mysql_migrate_keyring] group. If this option is given as
--defaults-group-suffix=_other,
mysql_migrate_keyring also reads
the [mysql_migrate_keyring_other] group.
For additional information about this and other option-file
options, see Section 4.2.2.3, “Command-Line Options that
Affect Option-File Handling”.
•
--destination-keyring=name
The destination keyring component for key migration. The format and
interpretation of the option value is the same as described for the
--source-keyring option.
Note
--component-dir,
--source-keyring, and
--destination-keyring are mandatory for all keyring migration
operations performed by
mysql_migrate_keyring. In addition, the source
and destination components must differ, and both components must be properly
configured so that
mysql_migrate_keyring can load and use them.
•--destination-keyring-configuration-dir=dir_name
This option applies only if the destination keyring component global
configuration file contains "read_local_config": true, indicating
that component configuration is contained in the local configuration file. The
option value specifies the directory containing that local file.
•
--get-server-public-key Request from the
server the public key required for RSA key pair-based password exchange. This
option applies to clients that authenticate with the caching_sha2_password
authentication plugin. For that plugin, the server does not send the public
key unless requested. This option is ignored for accounts that do not
authenticate with that plugin. It is also ignored if RSA-based password
exchange is not used, as is the case when the client connects to the server
using a secure connection.
If --server-public-key-path=file_name is
given and specifies a valid public key file, it takes precedence over
--get-server-public-key.
For information about the caching_sha2_password plugin, see
Section 6.4.1.2, “Caching SHA-2 Pluggable
Authentication”.
•--host=host_name, -h
host_name The host location of the running server that is
currently using one of the key migration keystores. Migration always occurs on
the local host, so the option always specifies a value for connecting to a
local server, such as localhost, 127.0.0.1, ::1, or the local host IP address
or host name.
•
--login-path=name Read
options from the named login path in the .mylogin.cnf login path file. A
“login path” is an option group containing options that specify
which MySQL server to connect to and which account to authenticate as. To
create or modify a login path file, use the
mysql_config_editor
utility. See
mysql_config_editor(1).
For additional information about this and other option-file
options, see Section 4.2.2.3, “Command-Line Options that
Affect Option-File Handling”.
•
--no-defaults Do not read any option
files. If program startup fails due to reading unknown options from an option
file,
--no-defaults can be used to prevent them from being read.
The exception is that the .mylogin.cnf file is read in all cases,
if it exists. This permits passwords to be specified in a safer way than on
the command line even when --no-defaults is used. To create
.mylogin.cnf, use the mysql_config_editor utility. See
mysql_config_editor(1).
For additional information about this and other option-file
options, see Section 4.2.2.3, “Command-Line Options that
Affect Option-File Handling”.
•
--online-migration This option is
mandatory when a running server is using the keyring. It tells
mysql_migrate_keyring to perform an online key migration. The option
has these effects:
•mysql_migrate_keyring connects to the
server using any connection options specified; these options are otherwise
ignored.
•After mysql_migrate_keyring connects to
the server, it tells the server to pause keyring operations. When key copying
is complete, mysql_migrate_keyring tells the server it can resume
keyring operations before disconnecting.
•
--password[=password],
-p[password] The password of the MySQL account
used for connecting to the running server that is currently using one of the
key migration keystores. The password value is optional. If not given,
mysql_migrate_keyring prompts for one. If given, there must be
no
space between
--password= or
-p and the password following
it. If no password option is specified, the default is to send no password.
Specifying a password on the command line should be considered
insecure. To avoid giving the password on the command line, use an option
file. See Section 6.1.2.1, “End-User Guidelines for Password
Security”.
To explicitly specify that there is no password and that
mysql_migrate_keyring should not prompt for one, use the
--skip-password option.
•--port=port_num, -P
port_num For TCP/IP connections, the port number for
connecting to the running server that is currently using one of the key
migration keystores.
•
--print-defaults Print the program name
and all options that it gets from option files.
For additional information about this and other option-file
options, see Section 4.2.2.3, “Command-Line Options that
Affect Option-File Handling”.
•
--server-public-key-path=file_name
The path name to a file in PEM format containing a client-side copy of the
public key required by the server for RSA key pair-based password exchange.
This option applies to clients that authenticate with the sha256_password or
caching_sha2_password authentication plugin. This option is ignored for
accounts that do not authenticate with one of those plugins. It is also
ignored if RSA-based password exchange is not used, as is the case when the
client connects to the server using a secure connection.
If --server-public-key-path=file_name is
given and specifies a valid public key file, it takes precedence over
--get-server-public-key.
For sha256_password, this option applies only if MySQL was built
using OpenSSL.
For information about the sha256_password and
caching_sha2_password plugins, see Section 6.4.1.3, “SHA-256
Pluggable Authentication”, and Section 6.4.1.2,
“Caching SHA-2 Pluggable Authentication”.
•
--socket=path,
-S
path For Unix socket file or Windows named pipe connections,
the socket file or named pipe for connecting to the running server that is
currently using one of the key migration keystores.
On Windows, this option applies only if the server was started
with the named_pipe system variable enabled to support named-pipe
connections. In addition, the user making the connection must be a member of
the Windows group specified by the named_pipe_full_access_group system
variable.
•
--source-keyring=name The
source keyring component for key migration. This is the component library file
name specified without any platform-specific extension such as .so or .dll.
For example, to use the component for which the library file is
component_keyring_file.so, specify the option as
--source-keyring=component_keyring_file.
Note
--component-dir,
--source-keyring, and
--destination-keyring are mandatory for all keyring migration
operations performed by
mysql_migrate_keyring. In addition, the source
and destination components must differ, and both components must be properly
configured so that
mysql_migrate_keyring can load and use them.
•--source-keyring-configuration-dir=dir_name
This option applies only if the source keyring component global configuration
file contains "read_local_config": true, indicating that component
configuration is contained in the local configuration file. The option value
specifies the directory containing that local file.
•--ssl* Options that begin with
--ssl specify whether to connect to the server using encryption and
indicate where to find SSL keys and certificates. See the section called
“Command Options for Encrypted Connections”.
•
--ssl-fips-mode={OFF|ON|STRICT} Controls
whether to enable FIPS mode on the client side. The
--ssl-fips-mode
option differs from other
--ssl-xxx options in that it is
not used to establish encrypted connections, but rather to affect which
cryptographic operations to permit. See Section 6.8, “FIPS
Support”.
These --ssl-fips-mode values are permitted:
•OFF: Disable FIPS mode.
•ON: Enable FIPS mode.
•STRICT: Enable “strict” FIPS
mode.
Note
If the OpenSSL FIPS Object Module is not available, the only permitted value for
--ssl-fips-mode is OFF. In this case, setting
--ssl-fips-mode to
ON or STRICT causes the client to produce a warning at startup and to operate
in non-FIPS mode.
As of MySQL 8.0.34, this option is deprecated. Expect it to be removed in a
future version of MySQL.
•--tls-ciphersuites=ciphersuite_list
The permissible ciphersuites for encrypted connections that use TLSv1.3. The
value is a list of one or more colon-separated ciphersuite names. The
ciphersuites that can be named for this option depend on the SSL library used
to compile MySQL. For details, see Section 6.3.2, “Encrypted
Connection TLS Protocols and Ciphers”.
•--tls-version=protocol_list
The permissible TLS protocols for encrypted connections. The value is a list
of one or more comma-separated protocol names. The protocols that can be named
for this option depend on the SSL library used to compile MySQL. For details,
see Section 6.3.2, “Encrypted Connection TLS Protocols and
Ciphers”.
•--user=user_name, -u
user_name The user name of the MySQL account used for
connecting to the running server that is currently using one of the key
migration keystores.
•--verbose, -v Verbose mode. Produce
more output about what the program does.
•--version, -V Display version
information and exit.