/usr/bin/mysql_secure_installation

/usr/bin/mysql_secure_installation  Ver 9.7.2-2 for Linux on x86_64 (Source distribution)
Copyright (c) 2009-2026 Percona LLC and/or its affiliates
Copyright (c) 2013, 2026, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

MySQL Configuration Utility.Usage: /usr/bin/mysql_secure_installation [OPTIONS]
  -?, --help          Display this help and exit.
  -h, --host=name     Connect to host.
  -p, --password[=name]
                      Password to connect to the server. If password is not
                      given it's asked from the tty.
  -P, --port=#        Port number to use for connection or 0 for default to, in
                      order of preference, my.cnf, $MYSQL_TCP_PORT,
                      /etc/services, built-in default (3306).
  --protocol=name     The protocol to use for connection (tcp, socket, pipe,
                      memory).
  -S, --socket=name   Socket file to be used for connection.
  --ssl-mode=name     SSL connection mode.
  --ssl-ca=name       CA file in PEM format.
  --ssl-capath=name   CA directory.
  --ssl-cert=name     X509 cert in PEM format.
  --ssl-cipher=name   SSL cipher to use.
  --ssl-key=name      X509 key in PEM format.
  --ssl-crl=name      Certificate revocation list.
  --ssl-crlpath=name  Certificate revocation list path.
  --tls-version=name  TLS version to use, permitted values are: TLSv1.2,
                      TLSv1.3
  --ssl-fips-mode=name
                      SSL FIPS mode (applies only for OpenSSL); permitted
                      values are: OFF, ON, STRICT
  --tls-ciphersuites=name
                      TLS v1.3 cipher to use.
  --ssl-session-data=name
                      Session data file to use to enable ssl session reuse
  --ssl-session-data-continue-on-failed-reuse
                      If set to ON, this option will allow connection to
                      succeed even if session data cannot be reused.
  --tls-sni-servername=name
                      The SNI server name to pass to server
  -u, --user=name     User for login if not root.
  -D, --use-default   Execute with no user interactivity

Default options are read from the following files in the given order:
/etc/mysql/my.cnf /etc/my.cnf ~/.my.cnf
The following groups are read: mysql_secure_installation mysql client
The following options may be given as the first argument:
--print-defaults        Print the program argument list and exit.
--no-defaults           Don't read default options from any option file,
                        except for login file.
--defaults-file=#       Only read default options from the given file #.
--defaults-extra-file=# Read this file after the global files are read.
--defaults-group-suffix=#
                        Also read groups with concat(group, suffix)
--login-path=#          Read this path from the login file.
--no-login-paths        Don't read login paths from the login path file.

Variables (--variable-name=value)
and boolean options {FALSE|TRUE}          Value (after reading options)
----------------------------------------- --------------------------------
host                                      localhost
port                                      0
socket                                    (No default value)
ssl-ca                                    (No default value)
ssl-capath                                (No default value)
ssl-cert                                  (No default value)
ssl-cipher                                (No default value)
ssl-key                                   (No default value)
ssl-crl                                   (No default value)
ssl-crlpath                               (No default value)
tls-version                               (No default value)
tls-ciphersuites                          (No default value)
ssl-session-data                          (No default value)
ssl-session-data-continue-on-failed-reuse FALSE
tls-sni-servername                        (No default value)
user                                      root
use-default                               FALSE