--default-auth=plugin --default-auth=plugin

关于使用哪种客户端身份验证插件的提示。请参见 第 8.2.17 节，“可插拔身份验证”。A hint about which client-side authentication plugin to use. See Section 8.2.17, “Pluggable Authentication”.

--host=host_name, -h host_name --host=host_name, -h host_name

MySQL 服务器运行的主机。该值可以是主机名、IPv4 地址或 IPv6 地址。默认值是 localhost。The host on which the MySQL server is running. The value can be a host name, IPv4 address, or IPv6 address. The default value is localhost.

--password[=pass_val], -p[pass_val] --password[=pass_val], -p[pass_val]

用于连接服务器的 MySQL 账户密码。密码值是可选的。如果未提供，客户端程序会提示输入。如果提供，--password= 或 -p 与随后密码之间 不能有空格。如果未指定密码选项，默认不会发送密码。The password of the MySQL account used for connecting to the server. The password value is optional. If not given, the client program prompts for one. If given, there must be no space between --password= or -p and the password following it. If no password option is specified, the default is to send no password.

在命令行中指定密码应被视为不安全。为了避免在命令行中输入密码，请使用选项文件。请参阅 第 8.1.2.1 节，“终端用户密码安全指南”。Specifying a password on the command line should be considered insecure. To avoid giving the password on the command line, use an option file. See Section 8.1.2.1, “End-User Guidelines for Password Security”.

若要明确指定没有密码，并且客户端程序不应提示输入密码，请使用 --skip-password 选项。To explicitly specify that there is no password and that the client program should not prompt for one, use the --skip-password option.

--password1[=pass_val] --password1[=pass_val]

之间不能有空格。如果未指定密码选项，默认是不发送密码。--password1=以用户名称The password for multifactor authentication factor 1 of the MySQL account used for connecting to the server. The password value is optional. If not given, the client program prompts for one. If given, there must be no space between --password1= and the password following it. If no password option is specified, the default is to send no password.

在命令行中指定密码应被视为不安全。为了避免在命令行中输入密码，请使用选项文件。请参阅 第 8.1.2.1 节，“终端用户密码安全指南”。Specifying a password on the command line should be considered insecure. To avoid giving the password on the command line, use an option file. See Section 8.1.2.1, “End-User Guidelines for Password Security”.

若要明确指定没有密码，并且客户端程序不提示输入密码，请使用 --skip-password1 选项。To explicitly specify that there is no password and that the client program should not prompt for one, use the --skip-password1 option.

--password1 和 --password 是同义词，--skip-password1 和 --skip-password 也是同义词。--password1 and --password are synonymous, as are --skip-password1 and --skip-password.

--password2[=pass_val]

用于连接到服务器的 MySQL 帐号的多因素认证第二因素的密码。此选项的语义与 --password1 的语义类似；详情请参见该选项的描述。The password for multifactor authentication factor 2 of the MySQL account used for connecting to the server. The semantics of this option are similar to the semantics for --password1; see the description of that option for details.

--password3[=pass_val]

用于连接到服务器的 MySQL 帐号的多因素认证第三因素的密码。此选项的语义与 --password1 的语义类似；详情请参见该选项的描述。The password for multifactor authentication factor 3 of the MySQL account used for connecting to the server. The semantics of this option are similar to the semantics for --password1; see the description of that option for details.

--pipe, -W

在 Windows 上，通过命名管道连接到服务器。此选项仅在服务器启动时已启用 named_pipe 系统变量以支持命名管道连接的情况下适用。此外，进行连接的用户必须是由 named_pipe_full_access_group 系统变量指定的 Windows 组的成员。On Windows, connect to the server using a named pipe. This option applies only if the server was started with the named_pipe system variable enabled to support named-pipe connections. In addition, the user making the connection must be a member of the Windows group specified by the named_pipe_full_access_group system variable.

--plugin-dir=dir_name --plugin-dir=dir_name

指定用于查找插件的目录。如果使用 --default-auth 选项指定了认证插件，但客户端程序未找到它，则需要指定此选项。请参阅 第 8.2.17 节，“可插拔认证”。The directory in which to look for plugins. Specify this option if the --default-auth option is used to specify an authentication plugin but the client program does not find it. See Section 8.2.17, “Pluggable Authentication”.

--port=port_num, -P port_num --port=port_num, -P port_num

对于 TCP/IP 连接，要使用的端口号。默认端口号是 3306。For TCP/IP connections, the port number to use. The default port number is 3306.

--protocol={TCP|SOCKET|PIPE|MEMORY}

此选项明确指定用于连接服务器的传输协议。当其他连接参数通常导致使用的协议不是您想要的协议时，此选项非常有用。例如，在 Unix 上连接到 localhost 时，默认使用 Unix 套接字文件进行连接：This option explicitly specifies which transport protocol to use for connecting to the server. It is useful when other connection parameters normally result in use of a protocol other than the one you want. For example, connections on Unix to localhost are made using a Unix socket file by default:

mysql --host=localhost

要强制使用 TCP/IP 传输，请指定 --protocol 选项：To force TCP/IP transport to be used instead, specify a --protocol option:

mysql --host=localhost --protocol=TCP

下表显示了允许的 --protocol 选项值，并指明了每个值适用的平台。这些值不区分大小写。The following table shows the permissible --protocol option values and indicates the applicable platforms for each value. The values are not case-sensitive.

另请参见 第 6.2.7 节，“连接传输协议”See also Section 6.2.7, “Connection Transport Protocols”

--shared-memory-base-name=name --shared-memory-base-name=name

在 Windows 上，通过共享内存连接到本地服务器时使用的共享内存名称。默认值是 MYSQL。共享内存名称区分大小写。On Windows, the shared-memory name to use for connections made using shared memory to a local server. The default value is MYSQL. The shared-memory name is case-sensitive.

此选项仅在服务器启用了 shared_memory 系统变量以支持共享内存连接时适用。This option applies only if the server was started with the shared_memory system variable enabled to support shared-memory connections.

--socket=path, -S path --socket=path, -S path

在 Unix 上，用于通过命名管道连接到本地服务器的 Unix 套接字文件的名称。默认的 Unix 套接字文件名是 /tmp/mysql.sock。On Unix, the name of the Unix socket file to use for connections made using a named pipe to a local server. The default Unix socket file name is /tmp/mysql.sock.

在 Windows 上，用于连接到本地服务器的命名管道的名称。默认的 Windows 管道名称是 MySQL。管道名称不区分大小写。On Windows, the name of the named pipe to use for connections to a local server. The default Windows pipe name is MySQL. The pipe name is not case-sensitive.

在 Windows 上，此选项仅在服务器启用支持命名管道连接的 named_pipe 系统变量启动时才适用。此外，进行连接的用户必须是由 named_pipe_full_access_group 系统变量指定的 Windows 组的成员。On Windows, this option applies only if the server was started with the named_pipe system variable enabled to support named-pipe connections. In addition, the user making the connection must be a member of the Windows group specified by the named_pipe_full_access_group system variable.

--user=user_name, -u user_name --user=user_name, -u user_name

用于连接服务器的 MySQL 账户用户名。默认用户名在 Windows 上为 ODBC，在 Unix 上为你的 Unix 登录名。The user name of the MySQL account to use for connecting to the server. The default user name is ODBC on Windows or your Unix login name on Unix.

--get-server-public-key --get-server-public-key

向服务器请求用于基于 RSA 密钥对的密码交换所需的公钥。此选项适用于使用 caching_sha2_password 身份验证插件进行身份验证的客户端。对于该插件，服务器不会发送公钥，除非被请求。对于未使用该插件进行身份验证的账户，此选项将被忽略。当未使用基于 RSA 的密码交换时（例如客户端使用安全连接连接服务器时），此选项也将被忽略。Request from the server the public key required for RSA key pair-based password exchange. This option applies to clients that authenticate with the caching_sha2_password authentication plugin. For that plugin, the server does not send the public key unless requested. This option is ignored for accounts that do not authenticate with that plugin. It is also ignored if RSA-based password exchange is not used, as is the case when the client connects to the server using a secure connection.

如果提供了 --server-public-key-path=file_name 并指定了有效的公钥文件，它将优先于 --get-server-public-key。If --server-public-key-path=file_name is given and specifies a valid public key file, it takes precedence over --get-server-public-key.

有关 caching_sha2_password 插件的信息，请参见 第 8.4.1.2 节，“缓存 SHA-2 可插拔认证”。For information about the caching_sha2_password plugin, see Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”.

--server-public-key-path=file_name --server-public-key-path=file_name

包含服务器所需的 RSA 密钥对密码交换的客户端副本公钥的 PEM 格式文件的路径名。此选项适用于使用 sha256_password（已弃用）或 caching_sha2_password 身份验证插件进行身份验证的客户端。对于不使用这些插件之一进行身份验证的帐户，将忽略此选项。如果未使用基于 RSA 的密码交换（例如客户端使用安全连接连接到服务器的情况），此选项也将被忽略。The path name to a file in PEM format containing a client-side copy of the public key required by the server for RSA key pair-based password exchange. This option applies to clients that authenticate with the sha256_password (deprecated) or caching_sha2_password authentication plugin. This option is ignored for accounts that do not authenticate with one of those plugins. It is also ignored if RSA-based password exchange is not used, as is the case when the client connects to the server using a secure connection.

如果提供了 --server-public-key-path=file_name 并指定了有效的公钥文件，它将优先于 --get-server-public-key。If --server-public-key-path=file_name is given and specifies a valid public key file, it takes precedence over --get-server-public-key.

此选项仅在 MySQL 使用 OpenSSL 构建时可用。This option is available only if MySQL was built using OpenSSL.

有关 sha256_password（已弃用）和 caching_sha2_password 插件的信息，请参阅 第 8.4.1.3 节，“SHA-256 可插拔认证”，以及 第 8.4.1.2 节，“缓存 SHA-2 可插拔认证”。For information about the sha256_password (deprecated) and caching_sha2_password plugins, see Section 8.4.1.3, “SHA-256 Pluggable Authentication”, and Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”.

--ssl-ca=file_name --ssl-ca=file_name

PEM 格式的证书颁发机构（CA）证书文件的路径名称。该文件包含受信任的 SSL 证书颁发机构列表。The path name of the Certificate Authority (CA) certificate file in PEM format. The file contains a list of trusted SSL Certificate Authorities.

要在建立与服务器的加密连接时告诉客户端不要验证服务器证书，请不要指定 --ssl-ca 或 --ssl-capath。服务器仍会根据为客户端帐户设定的任何适用要求验证客户端，并且仍会使用服务器端指定的任何 ssl_ca 或 ssl_capath 系统变量值。To tell the client not to authenticate the server certificate when establishing an encrypted connection to the server, specify neither --ssl-ca nor --ssl-capath. The server still verifies the client according to any applicable requirements established for the client account, and it still uses any ssl_ca or ssl_capath system variable values specified on the server side.

要为服务器指定 CA 文件，请设置 ssl_ca 系统变量。To specify the CA file for the server, set the ssl_ca system variable.

--ssl-capath=dir_name --ssl-capath=dir_name

包含受信任的 SSL 证书颁发机构 (CA) 证书文件（PEM 格式）的目录的路径名称。The path name of the directory that contains trusted SSL certificate authority (CA) certificate files in PEM format.

要在建立与服务器的加密连接时告诉客户端不要验证服务器证书，请不要指定 --ssl-ca 或 --ssl-capath。服务器仍会根据为客户端帐户设定的任何适用要求验证客户端，并且仍会使用服务器端指定的任何 ssl_ca 或 ssl_capath 系统变量值。To tell the client not to authenticate the server certificate when establishing an encrypted connection to the server, specify neither --ssl-ca nor --ssl-capath. The server still verifies the client according to any applicable requirements established for the client account, and it still uses any ssl_ca or ssl_capath system variable values specified on the server side.

要为服务器指定 CA 目录，请设置 ssl_capath 系统变量。To specify the CA directory for the server, set the ssl_capath system variable.

--ssl-cert=file_name --ssl-cert=file_name

客户端 SSL 公钥证书文件的路径名称，格式为 PEM。支持链式 SSL 证书。The path name of the client SSL public key certificate file in PEM format. Chained SSL certificates are supported.

要指定服务器 SSL 公钥证书文件，请设置 ssl_cert 系统变量。To specify the server SSL public key certificate file, set the ssl_cert system variable.

--ssl-cipher=cipher_list

TLSv1.2 连接可用的加密算法列表。如果列表中的加密算法都不被支持，使用这些 TLS 协议的加密连接将无法工作。The list of permissible encryption ciphers for connections that use TLSv1.2. If no cipher in the list is supported, encrypted connections that use these TLS protocols do not work.

为了获得最大的可移植性，cipher_list 应该是一个或多个密码名称的列表，用冒号分隔。例如：For greatest portability, cipher_list should be a list of one or more cipher names, separated by colons. Examples:

--ssl-cipher=AES128-SHA
--ssl-cipher=DHE-RSA-AES128-GCM-SHA256:AES128-SHA

OpenSSL 支持在 OpenSSL 文档中描述的指定密码的语法，见 https://www.openssl.org/docs/manmaster/man1/ciphers.html。OpenSSL supports the syntax for specifying ciphers described in the OpenSSL documentation at https://www.openssl.org/docs/manmaster/man1/ciphers.html.

有关 MySQL 支持的加密密码的信息，请参阅 第 8.3.2 节，“加密连接 TLS 协议和密码”。For information about which encryption ciphers MySQL supports, see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”.

要为服务器指定加密密码，请设置 ssl_cipher 系统变量。To specify the encryption ciphers for the server, set the ssl_cipher system variable.

--ssl-crl=file_name --ssl-crl=file_name

包含 PEM 格式证书吊销列表的文件的路径名。The path name of the file containing certificate revocation lists in PEM format.

如果既没有提供 --ssl-crl 也没有提供 --ssl-crlpath，即使 CA 路径中包含证书吊销列表，也不会执行 CRL 检查。If neither --ssl-crl nor --ssl-crlpath is given, no CRL checks are performed, even if the CA path contains certificate revocation lists.

要为服务器指定吊销列表文件，请设置 ssl_crl 系统变量。To specify the revocation-list file for the server, set the ssl_crl system variable.

--ssl-crlpath=dir_name

包含 PEM 格式证书撤销列表文件的目录的路径名称。The path name of the directory that contains certificate revocation-list files in PEM format.

如果既没有提供 --ssl-crl 也没有提供 --ssl-crlpath，即使 CA 路径中包含证书吊销列表，也不会执行 CRL 检查。If neither --ssl-crl nor --ssl-crlpath is given, no CRL checks are performed, even if the CA path contains certificate revocation lists.

要为服务器指定撤销列表目录，请设置 ssl_crlpath 系统变量。To specify the revocation-list directory for the server, set the ssl_crlpath system variable.

--ssl-fips-mode={OFF|ON|STRICT} --ssl-fips-mode={OFF|ON|STRICT}

控制是否在客户端启用 FIPS 模式。--ssl-fips-mode 选项与其他 --ssl-xxx 选项不同，它不是用于建立加密连接，而是用于影响允许使用哪些加密操作。参见 第 8.8 节，“FIPS 支持”。Controls whether to enable FIPS mode on the client side. The --ssl-fips-mode option differs from other --ssl-xxx options in that it is not used to establish encrypted connections, but rather to affect which cryptographic operations to permit. See Section 8.8, “FIPS Support”.

这些 --ssl-fips-mode 的值是允许的：These --ssl-fips-mode values are permissible:

要为服务器指定 FIPS 模式，请设置 ssl_fips_mode 系统变量。To specify the FIPS mode for the server, set the ssl_fips_mode system variable.

--ssl-key=file_name --ssl-key=file_name

客户端 SSL 私钥文件的路径名，格式为 PEM。为了更好的安全性，请使用 RSA 密钥大小至少为 2048 位的证书。The path name of the client SSL private key file in PEM format. For better security, use a certificate with an RSA key size of at least 2048 bits.

如果密钥文件受密码保护，客户端程序会提示用户输入密码。密码必须通过交互方式提供；不能存储在文件中。如果密码不正确，程序将继续执行，就好像无法读取密钥一样。If the key file is protected by a passphrase, the client program prompts the user for the passphrase. The password must be given interactively; it cannot be stored in a file. If the passphrase is incorrect, the program continues as if it could not read the key.

要指定服务器 SSL 私钥文件，请设置 ssl_key 系统变量。To specify the server SSL private key file, set the ssl_key system variable.

--ssl-mode=mode --ssl-mode=mode

此选项指定与服务器连接所需的安全状态。这些模式值是允许的，按严格程度递增的顺序：This option specifies the desired security state of the connection to the server. These mode values are permissible, in order of increasing strictness:

--ssl-mode 选项与 CA 证书选项的交互方式如下：The --ssl-mode option interacts with CA certificate options as follows:

要要求 MySQL 账户使用加密连接，请使用 CREATE USER 创建带有 REQUIRE SSL 子句的账户，或针对现有账户使用 ALTER USER 添加 REQUIRE SSL 子句。这样，如果 MySQL 支持加密连接且能够建立加密连接，否则使用该账户的客户端连接尝试将被拒绝。To require use of encrypted connections by a MySQL account, use CREATE USER to create the account with a REQUIRE SSL clause, or use ALTER USER for an existing account to add a REQUIRE SSL clause. This causes connection attempts by clients that use the account to be rejected unless MySQL supports encrypted connections and an encrypted connection can be established.

REQUIRE 子句允许使用其他与加密相关的选项，这些选项可以用于强制执行比 REQUIRE SSL 更严格的安全要求。有关使用配置了各种 REQUIRE 选项的帐户连接的客户端可能或必须指定哪些命令选项的更多详细信息，请参阅 CREATE USER SSL/TLS 选项。The REQUIRE clause permits other encryption-related options, which can be used to enforce security requirements stricter than REQUIRE SSL. For additional details about which command options may or must be specified by clients that connect using accounts configured using the various REQUIRE options, see CREATE USER SSL/TLS Options.

--ssl-session-data=file_name --ssl-session-data=file_name

用于会话重用的客户端 SSL 会话数据文件的 PEM 格式路径名。The path name of the client SSL session data file in PEM format for session reuse.

当你使用 --ssl-session-data 选项调用 MySQL 客户端程序时，客户端会尝试从提供的文件中反序列化会话数据，然后使用它建立新连接。如果你提供了一个文件，但会话未被重用，则连接会失败，除非你在调用客户端程序时在命令行上也指定了 --ssl-session-data-continue-on-failed-reuse 选项。When you invoke a MySQL client program with the --ssl-session-data option, the client attempts to deserialize session data from the file, if provided, and then use it to establish a new connection. If you supply a file, but the session is not reused, then the connection fails unless you also specified the --ssl-session-data-continue-on-failed-reuse option on the command line when you invoked the client program.

mysql 命令，ssl_session_data_print，生成会话数据文件（见 第 6.5.1.2 节，“mysql 客户端命令”）。The mysql command, ssl_session_data_print, generates the session data file (see Section 6.5.1.2, “mysql Client Commands”).

ssl-session-data-continue-on-failed-reuse

控制是否启动新连接以替换尝试连接但未能重用使用 --ssl-session-data 命令行选项指定的会话数据的连接。默认情况下，--ssl-session-data-continue-on-failed-reuse 命令行选项处于关闭状态，这会导致客户端程序在提供会话数据但未重用时返回连接失败。Controls whether a new connection is started to replace an attempted connection that tried but failed to reuse session data specified with the --ssl-session-data command-line option. By default, the --ssl-session-data-continue-on-failed-reuse command-line option is off, which causes a client program to return a connect failure when session data are supplied and not reused.

为了确保在会话重用失败时能够静默地开启一个新的、无关联的连接，请在调用 MySQL 客户端程序时同时使用 --ssl-session-data 和 --ssl-session-data-continue-on-failed-reuse 命令行选项。To ensure that a new, unrelated connection opens after session reuse fails silently, invoke MySQL client programs with both the --ssl-session-data and --ssl-session-data-continue-on-failed-reuse command-line options.

--tls-ciphersuites=ciphersuite_list --tls-ciphersuites=ciphersuite_list

此选项指定客户端允许用于使用 TLSv1.3 的加密连接的密码套件。该值是一列零个或多个以冒号分隔的密码套件名称。例如：This option specifies which ciphersuites the client permits for encrypted connections that use TLSv1.3. The value is a list of zero or more colon-separated ciphersuite names. For example:

mysql --tls-ciphersuites="suite1:suite2:suite3"

此选项可以命名的密码套件取决于用于编译 MySQL 的 SSL 库。如果未设置此选项，客户端允许使用默认的密码套件集合。如果将选项设置为空字符串，则不启用任何密码套件，并且无法建立加密连接。有关更多信息，请参见 第 8.3.2 节，“加密连接 TLS 协议和密码套件”。The ciphersuites that can be named for this option depend on the SSL library used to compile MySQL. If this option is not set, the client permits the default set of ciphersuites. If the option is set to the empty string, no ciphersuites are enabled and encrypted connections cannot be established. For more information, see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”.

要指定服务器允许使用的密码套件，请设置 tls_ciphersuites 系统变量。To specify which ciphersuites the server permits, set the tls_ciphersuites system variable.

--tls-version=protocol_list

此选项指定客户端允许用于加密连接的 TLS 协议。该值是一个由一个或多个逗号分隔的协议版本组成的列表。例如：This option specifies the TLS protocols the client permits for encrypted connections. The value is a list of one or more comma-separated protocol versions. For example:

mysql --tls-version="TLSv1.2,TLSv1.3"

可以为此选项命名的协议取决于用于编译 MySQL 的 SSL 库，以及 MySQL 服务器的版本。The protocols that can be named for this option depend on the SSL library used to compile MySQL, and on the MySQL Server release.

应选择允许的协议以避免在列表中留下 “漏洞”。例如，这些值没有漏洞：Permitted protocols should be chosen such as not to leave “holes” in the list. For example, these values do not have holes:

--tls-version="TLSv1.2,TLSv1.3"
--tls-version="TLSv1.3"

详情请参见 第 8.3.2 节，“加密连接 TLS 协议和密码”。For details, see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”.

要指定服务器允许的 TLS 协议，请设置 tls_version 系统变量。To specify which TLS protocols the server permits, set the tls_version system variable.

--compress, -C

尽可能压缩客户端和服务器之间传输的所有信息。Compress all information sent between the client and the server if possible.

此选项已被弃用。预计将在 MySQL 的未来版本中移除。请参阅 配置遗留连接压缩。This option is deprecated. Expect it to be removed in a future version of MySQL. See Configuring Legacy Connection Compression.

--compression-algorithms=value --compression-algorithms=value

允许用于与服务器连接的压缩算法。可用算法与 protocol_compression_algorithms 系统变量的算法相同。默认值为 uncompressed。The permitted compression algorithms for connections to the server. The available algorithms are the same as for the protocol_compression_algorithms system variable. The default value is uncompressed.

--zstd-compression-level=level --zstd-compression-level=level

用于与服务器连接时使用 zstd 压缩算法的压缩级别。允许的级别从 1 到 22，数值越大表示压缩级别越高。默认的 zstd 压缩级别为 3。对于不使用 zstd 压缩的连接，压缩级别设置没有效果。The compression level to use for connections to the server that use the zstd compression algorithm. The permitted levels are from 1 to 22, with larger values indicating increasing levels of compression. The default zstd compression level is 3. The compression level setting has no effect on connections that do not use zstd compression.