4.2.3 Command Options for Connecting to the Server

--default-auth=plugin

A hint about which client-side authentication plugin to use. See Section 6.2.17, “Pluggable Authentication”.

--host=host_name, -h host_name

The host on which the MySQL server is running. The value can be a host name, IPv4 address, or IPv6 address. The default value is localhost.

--password[=pass_val], -p[pass_val]

The password of the MySQL account used for connecting to the server. The password value is optional. If not given, the program prompts for one. If given, there must be no space between --password= or -p and the password following it. If no password option is specified, the default is to send no password.

Specifying a password on the command line should be considered insecure. To avoid giving the password on the command line, use an option file. See Section 6.1.2.1, “End-User Guidelines for Password Security”.

To explicitly specify that there is no password and that the client program should not prompt for one, use the --skip-password option.

--pipe, -W

On Windows, connect to the server using a named pipe. This option applies only if the server was started with the named_pipe system variable enabled to support named-pipe connections. In addition, the user making the connection must be a member of the Windows group specified by the named_pipe_full_access_group system variable.

--plugin-dir=dir_name

The directory in which to look for plugins. Specify this option if the --default-auth option is used to specify an authentication plugin but the client program does not find it. See Section 6.2.17, “Pluggable Authentication”.

--port=port_num, -P port_num

For TCP/IP connections, the port number to use. The default port number is 3306.

--protocol={TCP|SOCKET|PIPE|MEMORY}

This option explicitly specifies which protocol to use for connecting to the server. It is useful when other connection parameters normally result in use of a protocol other than the one you want. For example, connections on Unix to localhost are made using a Unix socket file by default:

mysql --host=localhost

To force a TCP/IP connection to be used instead, specify a --protocol option:

mysql --host=localhost --protocol=TCP

The following table shows the permissible --protocol option values and indicates the platforms on which each value may be used. The values are not case-sensitive.

--secure-auth

This option was removed in MySQL 8.0.3.

--shared-memory-base-name=name

On Windows, the shared-memory name to use for connections made using shared memory to a local server. The default value is MYSQL. The shared-memory name is case-sensitive.

This option applies only if the server was started with the shared_memory system variable enabled to support shared-memory connections.

--socket=path, -S path

On Unix, the name of the Unix socket file to use for connections made using a named pipe to a local server. The default Unix socket file name is /tmp/mysql.sock.

On Windows, the name of the named pipe to use for connections to a local server. The default Windows pipe name is MySQL. The pipe name is not case-sensitive.

On Windows, this option applies only if the server was started with the named_pipe system variable enabled to support named-pipe connections. In addition, the user making the connection must be a member of the Windows group specified by the named_pipe_full_access_group system variable.

--user=user_name, -u user_name

The user name of the MySQL account to use for connecting to the server. The default user name is ODBC on Windows or your Unix login name on Unix.

--get-server-public-key

Request from the server the public key required for RSA key pair-based password exchange. This option applies to clients that authenticate with the caching_sha2_password authentication plugin. For that plugin, the server does not send the public key unless requested. This option is ignored for accounts that do not authenticate with that plugin. It is also ignored if RSA-based password exchange is not used, as is the case when the client connects to the server using a secure connection.

If --server-public-key-path=file_name is given and specifies a valid public key file, it takes precedence over --get-server-public-key.

For information about the caching_sha2_password plugin, see Section 6.4.1.3, “Caching SHA-2 Pluggable Authentication”.

--server-public-key-path=file_name

The path name to a file containing a client-side copy of the public key required by the server for RSA key pair-based password exchange. The file must be in PEM format. This option applies to clients that authenticate with the sha256_password or caching_sha2_password authentication plugin. This option is ignored for accounts that do not authenticate with one of those plugins. It is also ignored if RSA-based password exchange is not used, as is the case when the client connects to the server using a secure connection.

If --server-public-key-path=file_name is given and specifies a valid public key file, it takes precedence over --get-server-public-key.

This option is available only if MySQL was built using OpenSSL.

For information about the sha256_password and caching_sha2_password plugins, see Section 6.4.1.2, “SHA-256 Pluggable Authentication”, and Section 6.4.1.3, “Caching SHA-2 Pluggable Authentication”.

--ssl, --skip-ssl

On the server side, the --ssl option specifies that the server permits but does not require encrypted connections. The option is enabled on the server side by default. --ssl is implied by other --ssl-xxx options, as indicated in the descriptions for those options.

The --ssl option can be specified in negated form as --skip-ssl or a synonym (--ssl=0, --disable-ssl). In this case, the option specifies that the server does not permit encrypted connections and overrides other --ssl-xxx options.

To specify additional parameters for encrypted connections, consider using at least --ssl-cert and --ssl-key on the server side and --ssl-ca on the client side. See Section 6.3.1, “Configuring MySQL to Use Encrypted Connections”, which also describes server capabilities for certificate and key file autogeneration and autodiscovery.

--ssl-ca=file_name

The path name of the Certificate Authority (CA) certificate file in PEM format. On the server side, this option implies --ssl.

To tell the client not to authenticate the server certificate when establishing an encrypted connection to the server, specify neither --ssl-ca nor --ssl-capath. The server still verifies the client according to any applicable requirements established for the client account, and it still uses any --ssl-ca or --ssl-capath option values specified on the server side.

--ssl-capath=dir_name

The path name of the directory that contains trusted SSL certificate authority (CA) certificate files in PEM format. On the server side, this option implies --ssl.

To tell the client not to authenticate the server certificate when establishing an encrypted connection to the server, specify neither --ssl-ca nor --ssl-capath. The server still verifies the client according to any applicable requirements established for the client account, and it still uses any --ssl-ca or --ssl-capath option values specified on the server side.

--ssl-cert=file_name

The path name of the SSL public key certificate file in PEM format. On the client side, this is the client public key certificate. On the server side, this is the server public key certificate. On the server side, this option implies --ssl.

If the server is started with an --ssl-cert option specifying a certificate that uses any of the preceding restricted ciphers or cipher categories, the server starts with support for encrypted connections disabled.

--ssl-cipher=cipher_list

The list of permissible ciphers for connection encryption. If no cipher in the list is supported, encrypted connections will not work. On the server side, this option implies --ssl.

For greatest portability, cipher_list should be a list of one or more cipher names, separated by colons. Examples:

--ssl-cipher=AES128-SHA
--ssl-cipher=DHE-RSA-AES128-GCM-SHA256:AES128-SHA

OpenSSL supports the syntax for specifying ciphers described in the OpenSSL documentation at https://www.openssl.org/docs/manmaster/man1/ciphers.html.

For information about which encryption ciphers MySQL supports, see Section 6.3.2, “Encrypted Connection Protocols and Ciphers”.

--ssl-crl=file_name

The path name of the file containing certificate revocation lists in PEM format. On the server side, this option implies --ssl.

If neither --ssl-crl nor --ssl-crlpath is given, no CRL checks are performed, even if the CA path contains certificate revocation lists.

--ssl-crlpath=dir_name

The path name of the directory that contains certificate revocation-list files in PEM format. On the server side, this option implies --ssl.

If neither --ssl-crl nor --ssl-crlpath is given, no CRL checks are performed, even if the CA path contains certificate revocation lists.

--ssl-fips-mode={OFF|ON|STRICT}

Controls whether to enable FIPS mode on the client side. The --ssl-fips-mode option differs from other --ssl-xxx options in that it is not used to establish encrypted connections, but rather to affect which cryptographic operations are permitted. See Section 6.5, “FIPS Support”.

These --ssl-fips-mode values are permissible:

To specify the FIPS mode for the server, use the ssl_fips_mode system variable.

--ssl-key=file_name

The path name of the SSL private key file in PEM format. On the client side, this is the client private key. On the server side, this is the server private key. On the server side, this option implies --ssl.

If the key file is protected by a passphrase, the program prompts the user for the passphrase. The password must be given interactively; it cannot be stored in a file. If the passphrase is incorrect, the program continues as if it could not read the key.

For better security, use a certificate with an RSA key size of at least 2048 bits.

--ssl-mode=mode

This option is available only for client programs, not the server. It specifies the desired security state of the connection to the server. These mode values are permissible, in order of increasing strictness:

The --ssl-mode option interacts with CA certificate options as follows:

To require use of encrypted connections by a MySQL account, use CREATE USER to create the account with a REQUIRE SSL clause, or use ALTER USER for an existing account to add a REQUIRE SSL clause. This causes connection attempts by clients that use the account to be rejected unless MySQL supports encrypted connections and an encrypted connection can be established.

The REQUIRE clause permits other encryption-related options, which can be used to enforce security requirements stricter than REQUIRE SSL. For additional details about which command options may or must be specified by clients that connect using accounts configured using the various REQUIRE options, see CREATE USER SSL/TLS Options.

--tls-ciphersuites=ciphersuite_list

For client programs, the permissible TLSv1.3 ciphersuites for encrypted connections. The value is a list of one or more colon-separated ciphersuite names. For example:

mysql --tls-ciphersuites="suite1:suite2:suite3"

The ciphersuites that can be named for this option depend on the SSL library used to compile MySQL. For details, see Section 6.3.2, “Encrypted Connection Protocols and Ciphers”.

This option was added in MySQL 8.0.16.

To specify which ciphersuites the server permits, use the tls_ciphersuites system variable.

--tls-version=protocol_list

For client programs, the TLS protocols the client permits for encrypted connections. The value is a list of one or more comma-separated protocol names. For example:

mysql --tls-version="TLSv1.1,TLSv1.2"

The protocols that can be named for this option depend on the SSL library used to compile MySQL. Permitted protocols should be chosen such as not to leave “holes” in the list. For example, these values do not have holes:

--tls-version="TLSv1,TLSv1.1,TLSv1.2,TLSv1.3"
--tls-version="TLSv1.1,TLSv1.2,TLSv1.3"
--tls-version="TLSv1.2,TLSv1.3"
--tls-version="TLSv1.3"

These values do have holes and should not be used:

--tls-version="TLSv1,TLSv1.2"
--tls-version="TLSv1.1,TLSv1.3"

For details, see Section 6.3.2, “Encrypted Connection Protocols and Ciphers”.

To specify which TLS protocols the server permits, use the tls_version system variable.

--compress, -C

Compress all information sent between the client and the server if possible.

As of MySQL 8.0.18, this option is deprecated. It will be removed in a future MySQL version. See Legacy Connection Compression Configuration.

--compression-algorithms=value

The permitted compression algorithms for connections to the server. The available algorithms are the same as for the protocol_compression_algorithms system variable. The default value is uncompressed.

This option was added in MySQL 8.0.18.

--zstd-compression-level=level

The compression level to use for connections to the server that use the zstd compression algorithm. The permitted levels are from 1 to 22, with larger values indicating increasing levels of compression. The default zstd compression level is 3. The compression level setting has no effect on connections that do not use zstd compression.

This option was added in MySQL 8.0.18.