MySQL 8.0 caching_sha2_password and legacy Connector/J: retaining mysql_native_password at the authentication boundary

Answer to the core question

Keep mysql_native_password enabled only for a small set of legacy accounts during migration, and require TLS for those accounts if the clients support it. Modern accounts should use caching_sha2_password with TLS enforced. Disabling mysql_native_password globally before legacy Connector/J clients are upgraded or confirmed to support TLS with RSA key exchange will break connections. Requiring TLS for all accounts is the defensible long-term posture, not the immediate starting point.

Confirmed facts

• MySQL 8.0 defaults default_authentication_plugin to caching_sha2_password.
• mysql_native_password is deprecated but still available in MySQL 8.0; its status in later 8.x minors varies by distribution.
• Connector/J 7.x and earlier cannot use caching_sha2_password; they need mysql_native_password or TLS with RSA key exchange.
• caching_sha2_password over an unencrypted connection fails unless RSA key exchange is negotiated, and unverified RSA exchange exposes the connection to man-in-the-middle attacks.
• Account plugins are stored in mysql.user; the server default is controlled by default_authentication_plugin.

Recommended boundary configuration

1. Verify the current server default:

   SHOW VARIABLES LIKE 'default_authentication_plugin';

2. List existing account plugins:

   SELECT User, Host, plugin FROM mysql.user;

3. Enable server TLS by configuring ssl-ca, ssl-cert, and ssl-key in the server option file, then restart.
4. Separate accounts by capability:
   • Legacy accounts:

     ALTER USER 'legacy_app'@'10.0.%' IDENTIFIED WITH 'mysql_native_password' BY 'password' REQUIRE SSL;

     Restrict the host to the internal legacy network segment.
   • Modern accounts:

     ALTER USER 'modern_app'@'%' IDENTIFIED WITH 'caching_sha2_password' BY 'password' REQUIRE SSL;

5. Test the legacy path by connecting with the legacy Connector/J over TLS. If it cannot validate the server certificate, keep the account on mysql_native_password but limit it to a trusted network and plan a client upgrade.
6. Remove mysql_native_password after migration. Once no legacy connector requires it, change those accounts to caching_sha2_password and consider disabling the plugin globally if the build allows it.

Assessing minor-version behavior

Run

SELECT @@version;

and consult the release notes for that exact 8.x minor. Some distributions ship with mysql_native_password enabled by default; explicitly set default_authentication_plugin = 'caching_sha2_password' in the server configuration to avoid accidental fallback. Treat any change in deprecation status as unverified until confirmed in the release notes for the installed patch level.

Missing diagnostic detail

One detail changes the recommendation: can the legacy Connector/J clients establish TLS and validate the server certificate? If they cannot, a temporary mysql_native_password account on an isolated network is the only compatible fallback. If they can, move them to caching_sha2_password with REQUIRE SSL now.