# Mysql, mariadb driver and allowPublicKeyRetreival **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [March 14, 2022, 1:00pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156 "2022-03-14T13:00:40Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![johannes.bo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/johannes.bo/32/27628_2.png) [@johannes.bo](https://forum.inductiveautomation.com/u/johannes.bo)\ **Post date:** [March 14, 2022, 1:00pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156/1 "2022-03-14T13:00:40Z")
I am running Ignition v8.1.9 and have a connection to a mysql database using mariadb driver. I initially got faulty database connection: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/2/1244d0d1a1409688459e671c5c05137c2789e4ff.png) I get this to work by adding “allowPublicKeyRetrieval=true” to the extra connection properties ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/a/eaee59d52871a217efa2687d062450b4da3fd105.png) -Is this the correct way of fixing this issue? 🙂 -What security compromises am I introducing? 😇 ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 14, 2022, 3:14pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156/2 "2022-03-14T15:14:24Z")
> **[MySQL Connection String Options for .NET/C# - MySqlConnector](https://mysqlconnector.net/connection-options/#AllowPublicKeyRetrieval)** > > A MySqlConnection is configured using a connection string. The connection string options are key/value pairs described on this page. > Note that `AllowPublicKeyRetrieval=True` could allow a malicious proxy to perform a MITM attack to get the plaintext password, so it is `False` by default and must be explicitly enabled. ---
**Author:** ![johannes.bo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/johannes.bo/32/27628_2.png) [@johannes.bo](https://forum.inductiveautomation.com/u/johannes.bo)\ **Post date:** [March 14, 2022, 4:11pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156/3 "2022-03-14T16:11:32Z")
What would you suggest to be the most secure solution to this issue? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 14, 2022, 4:45pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156/4 "2022-03-14T16:45:02Z")
I would suggest mutual TLS: [https://dev.mysql.com/doc/connector-j/8.0/en/connector-j-reference-using-ssl.html](https://dev.mysql.com/doc/connector-j/8.0/en/connector-j-reference-using-ssl.html) Though, that guide don’t drop directly into Ignition, some of the keystore manipulation steps are somewhat different for Ignition. I don’t know if anyone has a guide written up for TLS auth with MySQL. ---
**Author:** ![johannes.bo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/johannes.bo/32/27628_2.png) [@johannes.bo](https://forum.inductiveautomation.com/u/johannes.bo)\ **Post date:** [March 14, 2022, 7:46pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156/5 "2022-03-14T19:46:22Z")
I am on deep water here, even if I understand some of the basic principles of key-pairs etc… -By accident I was using mysql connector on previous project, and it seemed to work out of the box against Ignition. -Any Idea why? -Would it be more secure using another driver for my current project as well? -Or is mysql driver more un-secure by default? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 14, 2022, 7:57pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156/6 "2022-03-14T19:57:24Z")
It seems you've got a slightly different configuration going on here. This excerpt from Paul's link explains: > If the user account uses `sha256_password` authentication, the password must be protected during transmission; TLS is the preferred mechanism for this, but if it is not available then RSA public key encryption will be used. So you seem to have set up sha256\_password authentication but not SSL or TLS, which means to avoid sending the password presumably plaintext the database is now trying to use asymmetric encryption, but you haven't configured the client with the necessary public key and the database sending it to the client over plaintext is a security problem in its own right. [https://dev.mysql.com/doc/refman/8.0/en/sha256-pluggable-authentication.html](https://dev.mysql.com/doc/refman/8.0/en/sha256-pluggable-authentication.html) ---
**Author:** ![johannes.bo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/johannes.bo/32/27628_2.png) [@johannes.bo](https://forum.inductiveautomation.com/u/johannes.bo)\ **Post date:** [March 14, 2022, 9:05pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156/7 "2022-03-14T21:05:43Z")
![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/e/7e0cf6996c292de9fa8a947c14a370a7648ef845.png) You are right. I did not enable SSL/TLS. I will consider getting a SSL certificate Tnx for pointing me in the right direction ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 14, 2022, 9:07pm UTC](https://forum.inductiveautomation.com/t/mysql-mariadb-driver-and-allowpublickeyretreival/57156/8 "2022-03-14T21:07:54Z")
I’m not talking about enabling SSL/TLS for your Ignition Gateway, I’m talking about for the connection from the Gateway to your MySQL server.