The caching_sha2_password plugin exists in server and client forms:caching_sha2_password插件存在于服务器和客户端表单中：

The server-side plugin uses the sha2_cache_cleaner audit plugin as a helper to perform password cache management. 服务器端插件使用sha2_cache_cleaner审计插件作为助手来执行密码缓存管理。sha2_cache_cleaner, like caching_sha2_password, is built in and need not be installed.sha2_cache_cleaner与caching_sha2_password一样，是内置的，不需要安装。

To set up an account that uses the caching_sha2_password plugin for SHA-256 password hashing, use the following statement, where password is the desired account password:要设置一个使用caching_sha2_password插件进行SHA-256密码哈希的帐户，请使用以下语句，其中password是所需的帐户密码：

CREATE USER 'sha2user'@'localhost'
IDENTIFIED WITH caching_sha2_password BY 'password';

The server assigns the caching_sha2_password plugin to the account and uses it to encrypt the password using SHA-256, storing those values in the plugin and authentication_string columns of the mysql.user system table.服务器将caching_sha2_password插件分配给帐户，并使用它使用SHA-256对密码进行加密，将这些值存储在mysql.user系统表的插件和authentication_string列中。

The preceding instructions do not assume that caching_sha2_password is the default authentication plugin. 前面的说明并不假设caching_sha2_password是默认的身份验证插件。If caching_sha2_password is the default authentication plugin, a simpler CREATE USER syntax can be used.如果默认身份验证插件是caching_sha2_password，则可以使用更简单的CREATE USER语法。

To start the server with the default authentication plugin set to caching_sha2_password, put these lines in the server option file:要使用设置为caching_sha2_password的默认身份验证插件启动服务器，请将以下行放入服务器选项文件中：

[mysqld]
default_authentication_plugin=caching_sha2_password

That causes the caching_sha2_password plugin to be used by default for new accounts. As a result, it is possible to create the account and set its password without naming the plugin explicitly:这会导致默认情况下新帐户使用caching_sha2_password插件。因此，可以创建帐户并设置密码，而无需显式命名插件：

CREATE USER 'sha2user'@'localhost' IDENTIFIED BY 'password';

Another consequence of setting default_authentication_plugin to caching_sha2_password is that, to use some other plugin for account creation, you must specify that plugin explicitly. 将default_authentication_plugin设置为caching_sha2_password的另一个后果是，要使用其他插件创建帐户，您必须明确指定该插件。For example, to use the mysql_native_password plugin, use this statement:例如，要使用mysql_native_password插件，请使用以下语句：

CREATE USER 'nativeuser'@'localhost'
IDENTIFIED WITH mysql_native_password BY 'password';

caching_sha2_password supports connections over secure transport. caching_sha2_password支持通过安全传输进行连接。If you follow the RSA configuration procedure given later in this section, it also supports encrypted password exchange using RSA over unencrypted connections. 如果您遵循本节稍后给出的RSA配置过程，它还支持在未加密的连接上使用RSA进行加密密码交换。RSA support has these characteristics:RSA支持具有以下特点：

For clients that use the caching_sha2_password plugin, passwords are never exposed as cleartext when connecting to the server. How password transmission occurs depends on whether a secure connection or RSA encryption is used:对于使用caching_sha2_password插件的客户端，在连接到服务器时，密码永远不会以明文形式公开。密码传输的方式取决于使用的是安全连接还是RSA加密：

To enable use of an RSA key pair for password exchange during the client connection process, use the following procedure:要在客户端连接过程中使用RSA密钥对进行密码交换，请使用以下过程：

After the server has been configured with the RSA key files, accounts that authenticate with the caching_sha2_password plugin have the option of using those key files to connect to the server. 在服务器配置了RSA密钥文件后，使用caching_sha2_password插件进行身份验证的帐户可以选择使用这些密钥文件连接到服务器。As mentioned previously, such accounts can use either a secure connection (in which case RSA is not used) or an unencrypted connection that performs password exchange using RSA. 如前所述，此类帐户可以使用安全连接（在这种情况下不使用RSA）或使用RSA进行密码交换的未加密连接。Suppose that an unencrypted connection is used. For example:假设使用了未加密的连接。例如：

shell> mysql --ssl-mode=DISABLED -u sha2user -p
Enter password: password

For this connection attempt by sha2user, the server determines that caching_sha2_password is the appropriate authentication plugin and invokes it (because that was the plugin specified at CREATE USER time). 对于sha2user的此连接尝试，服务器确定caching_sha2_password是适当的身份验证插件并调用它（因为这是在CREATE USER时指定的插件）。The plugin finds that the connection is not encrypted and thus requires the password to be transmitted using RSA encryption. 插件发现连接未加密，因此要求使用RSA加密传输密码。However, the server does not send the public key to the client, and the client provided no public key, so it cannot encrypt the password and the connection fails:但是，服务器不向客户端发送公钥，客户端也没有提供公钥，因此无法加密密码，连接失败：

ERROR 2061 (HY000): Authentication plugin 'caching_sha2_password'
reported error: Authentication requires secure connection.

To request the RSA public key from the server, specify the --get-server-public-key option:要从服务器请求RSA公钥，请指定--get-server-public-key选项：

shell> mysql --ssl-mode=DISABLED -u sha2user -p --get-server-public-key
Enter password: password

In this case, the server sends the RSA public key to the client, which uses it to encrypt the password and returns the result to the server. The plugin uses the RSA private key on the server side to decrypt the password and accepts or rejects the connection based on whether the password is correct.在这种情况下，服务器将RSA公钥发送给客户端，客户端使用它来加密密码，并将结果返回给服务器。该插件使用服务器端的RSA私钥解密密码，并根据密码是否正确接受或拒绝连接。

Alternatively, if the client has a file containing a local copy of the RSA public key required by the server, it can specify the file using the --server-public-key-path option:或者，如果客户端有一个文件包含服务器所需的RSA公钥的本地副本，则可以使用--server-public-key-path选项指定该文件：

shell> mysql --ssl-mode=DISABLED -u sha2user -p --server-public-key-path=file_name
Enter password: password

In this case, the client uses the public key to encrypt the password and returns the result to the server. The plugin uses the RSA private key on the server side to decrypt the password and accepts or rejects the connection based on whether the password is correct.在这种情况下，客户端使用公钥对密码进行加密，并将结果返回给服务器。该插件使用服务器端的RSA私钥解密密码，并根据密码是否正确接受或拒绝连接。

The public key value in the file named by the --server-public-key-path option should be the same as the key value in the server-side file named by the caching_sha2_password_public_key_path system variable. 由--server-public-key-path选项命名的文件中的公钥值应与由caching_sha2_password_public_key_path系统变量命名的服务器端文件中的键值相同。If the key file contains a valid public key value but the value is incorrect, an access-denied error occurs. If the key file does not contain a valid public key, the client program cannot use it.如果密钥文件包含有效的公钥值，但该值不正确，则会发生拒绝访问错误。如果密钥文件不包含有效的公钥，则客户端程序无法使用它。

Client users can obtain the RSA public key two ways:客户端用户可以通过两种方式获取RSA公钥：

On the server side, the caching_sha2_password plugin uses an in-memory cache for faster authentication of clients who have connected previously. Entries consist of account-name/password-hash pairs. The cache works like this:在服务器端，caching_sha2_password插件使用内存缓存来更快地验证以前连接过的客户端。条目由帐户名/密码哈希对组成。缓存的工作原理如下：

In this way, when a client first connects, authentication against the mysql.user system table occurs. When the client connects subsequently, faster authentication against the cache occurs.这样，当客户端首次连接时，就会对mysql.user系统表进行身份验证。当客户端随后连接时，会对缓存进行更快的身份验证。

Password cache operations other than adding entries are handled by the sha2_cache_cleaner audit plugin, which performs these actions on behalf of caching_sha2_password:除添加条目外的密码缓存操作由sha2_cache_cleaner审核插件处理，该插件代表caching_sha2_Password执行这些操作：

Cache clearing operations affect the authentication requirements for subsequent client connections. For each user account, the first client connection for the user after any of the following operations must use a secure connection (made using TCP using TLS credentials, a Unix socket file, or shared memory) or RSA key pair-based password exchange:缓存清除操作会影响后续客户端连接的身份验证要求。对于每个用户帐户，在执行以下任何操作后，用户的第一个客户端连接必须使用安全连接（使用TCP使用TLS凭据、Unix套接字文件或共享内存）或基于RSA密钥对的密码交换：

FLUSH PRIVILEGES clears the entire cache and affects all accounts that use the caching_sha2_password plugin. The other operations clear specific cache entries and affect only accounts that are part of the operation.FLUSH PRIVILEGES会清除整个缓存，并影响使用caching_sha2_password插件的所有帐户。其他操作清除特定的缓存条目，仅影响作为操作一部分的帐户。

Once the user authenticates successfully, the account is entered into the cache and subsequent connections do not require a secure connection or the RSA key pair, until another cache clearing event occurs that affects the account.一旦用户成功通过身份验证，该帐户将被输入缓存，随后的连接不需要安全连接或RSA密钥对，直到发生影响该帐户的另一个缓存清除事件。 (When the cache can be used, the server uses a challenge-response mechanism that does not use cleartext password transmission and does not require a secure connection.)（当可以使用缓存时，服务器使用质询-响应机制，该机制不使用明文密码传输，也不需要安全连接。）