MySQL “Public Key Retrieval is not allowed”: upgrade the client or use SSL
Upgrade the client/connector, enable SSL, or allow public-key retrieval only on trusted local connections.
Best fix: upgrade the MySQL client/connector to one that supports caching_sha2_password, or connect with SSL. For local dev only, allowPublicKeyRetrieval=true in the connection string works — never use it over the internet.
Try these fixes in order
Check the client version
mysql --version shows whether the client predates caching_sha2_password support.
mysql --versionTry with SSL required
This avoids the public-key exchange entirely by encrypting the session.
mysql --ssl-mode=REQUIRED -u app -p -h dbhostOr fetch the key on trusted local connections
Localhost-only workaround for clients that cannot be upgraded. Never use this over untrusted networks.
mysql --get-server-public-key -u app -p -h 127.0.0.1Upgrade the connector long-term
Upgrading the driver or client is the durable fix; the flags are workarounds.
pip install --upgrade mysql-connector-pythonInterpret what you see
Old mysql client, old JDBC driver, or old ORM version
What it suggests: MySQL 8 made caching_sha2_password the default plugin; old clients predate it and fail this way.
Next check: Upgrade the MySQL client or connector to a version that supports caching_sha2_password.
The server has SSL available
What it suggests: With an encrypted connection the key exchange is safe and the error does not occur.
Next check: Connect with --ssl-mode=REQUIRED if the server supports it.
Localhost development with an unfixable old client
What it suggests: For local development only, the client flag permits the key fetch over a trusted loopback connection.
Next check: Add allowPublicKeyRetrieval=true to the connection string for local dev.
Why this happens
- The server account uses caching_sha2_password (the MySQL 8 default) but the client or connector is too old to do the full authentication exchange.
- The connection is not using SSL, so the client refuses to send the password or fetch the public key.
Still not working?
Do not set allowPublicKeyRetrieval=true on internet-facing connections; it can expose the password to a man-in-the-middle. Prefer upgrading the client or enabling SSL instead.
Official sources
These steps are based on the linked documentation and general diagnostics. BugMedic has not independently tested every product and system configuration. Review commands before running them.