The sha256_password plugin exists in server and client forms:sha256_password插件存在于服务器和客户端表单中：

To set up an account that uses the sha256_password plugin for SHA-256 password hashing, use the following statement, where password is the desired account password:要设置一个使用sha256_password插件进行SHA-256密码哈希的帐户，请使用以下语句，其中password是所需的帐户密码：

CREATE USER 'sha256user'@'localhost'
IDENTIFIED WITH sha256_password BY 'password';

The server assigns the sha256_password plugin to the account and uses it to encrypt the password using SHA-256, storing those values in the plugin and authentication_string columns of the mysql.user system table.服务器将sha256_password插件分配给帐户，并使用它使用SHA-256对密码进行加密，将这些值存储在mysql.user系统表的plugin和authentication_string列中。

The preceding instructions do not assume that sha256_password is the default authentication plugin. 前面的说明并不假设sha256_password是默认的身份验证插件。If sha256_password is the default authentication plugin, a simpler CREATE USER syntax can be used.如果sha256_password是默认的身份验证插件，则可以使用更简单的CREATE USER语法。

To start the server with the default authentication plugin set to sha256_password, put these lines in the server option file:要使用设置为sha256_password的默认身份验证插件启动服务器，请将以下行放入服务器选项文件中：

[mysqld]
default_authentication_plugin=sha256_password

That causes the sha256_password plugin to be used by default for new accounts. As a result, it is possible to create the account and set its password without naming the plugin explicitly:这会导致默认情况下新帐户使用sha256_password插件。因此，可以创建帐户并设置密码，而无需显式命名插件：

CREATE USER 'sha256user'@'localhost' IDENTIFIED BY 'password';

Another consequence of setting default_authentication_plugin to sha256_password is that, to use some other plugin for account creation, you must specify that plugin explicitly. 将default_authentication_plugin设置为sha256_password的另一个后果是，要使用其他插件创建帐户，您必须明确指定该插件。For example, to use the mysql_native_password plugin, use this statement:例如，要使用mysql_native_password插件，请使用以下语句：

CREATE USER 'nativeuser'@'localhost'
IDENTIFIED WITH mysql_native_password BY 'password';

sha256_password supports connections over secure transport. sha256_password支持通过安全传输进行连接。sha256_password also supports encrypted password exchange using RSA over unencrypted connections if MySQL is compiled using OpenSSL, and the MySQL server to which you wish to connect is configured to support RSA (using the RSA configuration procedure given later in this section).如果MySQL是使用OpenSSL编译的，并且您要连接的MySQL服务器配置为支持RSA（使用本节稍后给出的RSA配置过程），则sha256_password还支持在未加密的连接上使用RSA进行加密密码交换。

RSA support has these characteristics:RSA支持具有以下特点：

For clients that use the sha256_password plugin, passwords are never exposed as cleartext when connecting to the server. How password transmission occurs depends on whether a secure connection or RSA encryption is used:对于使用sha256_password插件的客户端，连接到服务器时密码永远不会以明文形式公开。密码传输的方式取决于使用的是安全连接还是RSA加密：

Assuming that MySQL has been compiled using OpenSSL, use the following procedure to enable use of an RSA key pair for password exchange during the client connection process:假设MySQL是使用OpenSSL编译的，请使用以下过程在客户端连接过程中启用RSA密钥对进行密码交换：

After the server has been configured with the RSA key files, accounts that authenticate with the sha256_password plugin have the option of using those key files to connect to the server. 在服务器配置了RSA密钥文件后，使用sha256_password插件进行身份验证的帐户可以选择使用这些密钥文件连接到服务器。As mentioned previously, such accounts can use either a secure connection (in which case RSA is not used) or an unencrypted connection that performs password exchange using RSA. Suppose that an unencrypted connection is used. For example:如前所述，此类帐户可以使用安全连接（在这种情况下不使用RSA）或使用RSA进行密码交换的未加密连接。假设使用了未加密的连接。例如：

shell> mysql --ssl-mode=DISABLED -u sha256user -p
Enter password: password

For this connection attempt by sha256user, the server determines that sha256_password is the appropriate authentication plugin and invokes it (because that was the plugin specified at CREATE USER time). 对于sha256user的此连接尝试，服务器确定sha256_password是适当的身份验证插件并调用它（因为这是在CREATE USER时指定的插件）。The plugin finds that the connection is not encrypted and thus requires the password to be transmitted using RSA encryption. 插件发现连接未加密，因此要求使用RSA加密传输密码。In this case, the plugin sends the RSA public key to the client, which uses it to encrypt the password and returns the result to the server. 在这种情况下，插件将RSA公钥发送给客户端，客户端使用它来加密密码，并将结果返回给服务器。The plugin uses the RSA private key on the server side to decrypt the password and accepts or rejects the connection based on whether the password is correct.该插件使用服务器端的RSA私钥解密密码，并根据密码是否正确接受或拒绝连接。

The server sends the RSA public key to the client as needed. However, if the client has a file containing a local copy of the RSA public key required by the server, it can specify the file using the --server-public-key-path option:服务器根据需要向客户端发送RSA公钥。但是，如果客户端有一个文件包含服务器所需的RSA公钥的本地副本，则可以使用--server-public-key-path选项指定该文件：

shell> mysql --ssl-mode=DISABLED -u sha256user -p --server-public-key-path=file_name
Enter password: password

The public key value in the file named by the --server-public-key-path option should be the same as the key value in the server-side file named by the sha256_password_public_key_path system variable. 由--server-public-key-path选项命名的文件中的公钥值应与由sha256_password_public_key_path系统变量命名的服务器端文件中的键值相同。If the key file contains a valid public key value but the value is incorrect, an access-denied error occurs. If the key file does not contain a valid public key, the client program cannot use it. 如果密钥文件包含有效的公钥值，但该值不正确，则会发生拒绝访问错误。如果密钥文件不包含有效的公钥，则客户端程序无法使用它。In this case, the sha256_password plugin sends the public key to the client as if no --server-public-key-path option had been specified.在这种情况下，sha256_password插件将公钥发送给客户端，就像没有指定--server-public-key-path选项一样。

Client users can obtain the RSA public key two ways:客户端用户可以通过两种方式获取RSA公钥：