MySQL

How to Fix MySQL "Client Does Not Support Authentication Protocol Requested by Server"

4 min read by DebuggedIt

Quick answer

An older MySQL client — a legacy application, an outdated driver, or an older command-line tool — fails to connect to a newer MySQL server with an...

An older MySQL client — a legacy application, an outdated driver, or an older command-line tool — fails to connect to a newer MySQL server with an authentication protocol error. This is a version compatibility issue: MySQL changed its default authentication plugin in version 8.0, and clients built before that change simply don't understand how to speak the new protocol.

The Problem

A connection attempt fails immediately at the authentication stage, before reaching any query:

$ mysql -u app_user -p -h mydb.example.com
ERROR 2059 (HY000): Authentication plugin 'caching_sha2_password' cannot be loaded:
/usr/lib/mysql/plugin/caching_sha2_password.so: cannot open shared object file

Or, from an older client library specifically:

Client does not support authentication protocol requested by server;
consider upgrading MySQL client

Why It Happens

MySQL 8.0 changed the default authentication plugin from mysql_native_password to caching_sha2_password, which is more secure but isn't understood by older client libraries and tools built before this change became widespread. This error appears in one of two related scenarios:

  • An old client library connecting to a MySQL 8+ server where the user account uses the newer default authentication plugin, and the client genuinely has no code path to handle it.
  • An older PHP, Python, Node.js, or other language driver that predates caching_sha2_password support, common when an application hasn't updated its database driver dependency in a while even though the database server itself has been upgraded.
  • A MySQL client binary itself being outdated relative to the server, distinct from the application driver issue — the command-line mysql tool itself can be the outdated piece.

The Fix

The more forward-compatible, generally preferred fix is upgrading the outdated client or driver rather than downgrading the server's security posture — check your driver's changelog for when caching_sha2_password support was added and update to at least that version:

# Example: Node.js mysql2 driver, which has long supported caching_sha2_password
npm install mysql2@latest
# Example: Python
pip install --upgrade mysqlclient
# or, better long-term, migrate to the actively maintained PyMySQL or mysql-connector-python

For the command-line client itself, install a current version rather than relying on your OS's potentially outdated default package:

# Debian/Ubuntu — add the official MySQL APT repository for current client versions
wget https://dev.mysql.com/get/mysql-apt-config_0.8.29-1_all.deb
sudo dpkg -i mysql-apt-config_0.8.29-1_all.deb
sudo apt update
sudo apt install mysql-client

If upgrading the client genuinely isn't feasible in the short term (a legacy application you can't immediately modify, a vendor tool you don't control), switch the specific MySQL user account back to the older, more broadly compatible authentication plugin as a targeted workaround:

ALTER USER 'app_user'@'%' IDENTIFIED WITH mysql_native_password BY 'your_password';
FLUSH PRIVILEGES;

This makes that specific account compatible with older clients while leaving MySQL's server-wide default plugin unchanged for every other account, limiting the reduced security posture to only the specific legacy connection that genuinely needs it.

If you need this behavior for every new user by default rather than setting it per-account, you can change the server's default authentication plugin — but treat this as a broader compatibility trade-off, not a first choice, since it affects every future account created on the server:

# my.cnf
[mysqld]
default_authentication_plugin=mysql_native_password

This requires a server restart to take effect and only affects newly created accounts going forward, not existing ones — existing accounts keep whatever plugin they were already assigned.

Still Not Working?

If you've updated the client but the error persists, confirm the actual authentication plugin the specific user account is currently using, since the client-side fix only helps if the account itself is actually on the plugin your updated client now supports:

SELECT user, host, plugin FROM mysql.user WHERE user = 'app_user';
+----------+------+-----------------------+
| user     | host | plugin                |
+----------+------+-----------------------+
| app_user | %    | caching_sha2_password  |
+----------+------+-----------------------+

If it shows caching_sha2_password and your client is now confirmed to support it (check your driver's release notes explicitly rather than assuming), the connection should work — if it still fails, double-check you're actually connecting to the server and port you expect, since a connection accidentally routed to an older, different MySQL instance would show this exact same symptom for entirely unrelated reasons.

You might also like