Repository navigation
[Proposal]: Certificate based authentication #160
Description
Pre-flight Checklist
- I have searched existing GitHub issues and did not find a duplicate proposal.
- I have removed or redacted sensitive information.
Primary Contact Name
Marek Szymczak
Primary Contact Email
Company / Organization
Oracle
Role
Software Engineer
Additional Authors / Contributors
Harin Vadodaria harin.vadodaria@oracle.com
Component
Server
Target Release (Optional)
27.1.0
Roadmap Section
Developer/DBA Experience
Related Issues / Pull Requests / References (Optional)
No response
Executive Summary
By default, MySQL uses password-based authentication, which can create operational challenges when multiple applications access the same database. Password rotation requires updating credentials across all dependent applications, increasing maintenance effort and the risk of service disruptions.
This feature introduces SSL certificate-based authentication, allowing users to authenticate with an SSL certificate instead of a password.
User / Developer Stories
This feature benefits database administrators, application developers, and operations teams managing environments where multiple applications connect to MySQL. Certificate-based authentication reduces the need to coordinate password changes across dependent applications, simplifying credential management and lowering the risk of service disruptions. Organizations that already use certificate management infrastructure can integrate MySQL authentication into their existing certificate issuance and renewal workflows.
Proposed Scope
A new authentication plugin.
Out of Scope / Future Work
No response
References
No response
Functional Requirements
No response
Non-functional Requirements
No response
Impact Areas
- SQL syntax or statements
- Configuration options or system variables
- Command-line options or utilities
- User-visible behavior
- Observability
- Security or privilege model
- Protocol or replication behavior
- Upgrade / downgrade compatibility
- Performance or resource usage
- Files, persistence, or metadata formats
- APIs or internal interfaces
- Testing or QA coverage needs
Summary of the Approach
No response
User Interface
No response
Configuration / Knobs
No response
Observability
No response
User Procedure
No response
Security Considerations
No response
Compatibility and Behavior Changes
No response
Block Diagram
No response
Interface Specification
No response
Proposed Implementation Plan
No response
QA Notes
No response
Activity