How to fix CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error in MySQL

MySQLINTERMEDIATEMEDIUMUpdated Dec 22, 2025· 156 views

Error 2061 occurs when the MySQL server selects an authentication plugin (usually caching_sha2_password in MySQL 8.0+) that the client cannot properly execute. Fix by using SSL/TLS, requesting the RSA public key, or changing the authentication plugin.

Quick fix

Fixes CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error

SELECT User, Host, plugin FROM mysql.user WHERE User = 'your_username';
  1. Check the current authentication plugin for your user
  2. Solution 1: Switch to mysql_native_password (quickest fix)
  3. Solution 2: Use SSL/TLS encrypted connection (recommended for security)
  4. Solution 3: Request RSA public key during connection (unencrypted backup)
mysql — error
SELECT User, Host, plugin FROM mysql.user WHERE User = 'your_username';
CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error

What this error means

Error 2061 (CR_AUTH_PLUGIN_ERR) indicates that MySQL's authentication plugin system failed during the connection handshake. The server chooses a specific authentication method based on the user account configuration, but the client either doesn't support that method, lacks required encryption capabilities, or has outdated authentication libraries. This is a server-side authentication protocol enforcement that prevents the connection from completing.

Typical symptoms

  • Connection fails immediately after providing correct username and password
  • Error message mentions "Authentication plugin 'caching_sha2_password' reported error"
  • Occurs after upgrading from MySQL 5.7 to MySQL 8.0 or higher
  • Database clients like mysql-cli, Node.js applications, or GUI tools cannot connect
  • Error may specifically mention "Authentication requires secure connection"

Common causes

  1. MySQL 8.0+ defaults to caching_sha2_password authentication plugin, but your client uses mysql_native_password or has outdated libraries
  2. Connection lacks SSL/TLS encryption, forcing the caching_sha2_password plugin to require RSA public key exchange, which fails when the server doesn't send the key
  3. Client library is too old to support the caching_sha2_password plugin (common with mysql CLI drivers, Sequelize, or older mysql/mysql2 npm packages)
  4. Server has a custom authentication plugin installed, but the client lacks the plugin binary or cannot load it
  5. Missing MySQL plugin packages on the server (e.g., mysql-community-server-plugins not installed on Linux)

How to fix "CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error"

1Check the current authentication plugin for your user

Connect to MySQL as an administrator and verify which authentication plugin is assigned to your user:

sql
SELECT User, Host, plugin FROM mysql.user WHERE User = 'your_username';

Note the plugin name. If it shows caching_sha2_password or sha256_password, you've found the cause.

2Solution 1: Switch to mysql_native_password (quickest fix)

Alter the user to use the older, widely-supported mysql_native_password authentication method. This is the fastest way to restore connectivity:

sql
ALTER USER 'your_username'@'your_host' IDENTIFIED WITH mysql_native_password BY 'your_password';
FLUSH PRIVILEGES;

Replace your_username and your_host with the actual user and host. The host is often localhost for local connections or % for remote access. After running this, your client should connect successfully.

3Solution 2: Use SSL/TLS encrypted connection (recommended for security)

If you want to keep caching_sha2_password (more secure), establish an SSL/TLS connection to MySQL. This allows the plugin to transmit the password safely without RSA encryption fallback:

For mysql CLI:

bash
mysql --ssl-mode=REQUIRED -u your_username -h your_host -p

For Node.js with mysql2/promise:

javascript
const connection = await mysql.createConnection({
  host: 'your_host',
  user: 'your_username',
  password: 'your_password',
  database: 'your_database',
  ssl: 'amazon', // or true, or path to CA cert
});

For other languages: Configure your database driver to use SSL (consult your library's documentation).

4Solution 3: Request RSA public key during connection (unencrypted backup)

If you cannot use SSL, request the server to send its RSA public key so the client can encrypt the password:

For mysql CLI:

bash
mysql --ssl-mode=DISABLED -u your_username -h your_host -p --get-server-public-key

For Node.js with mysql2/promise:

javascript
const connection = await mysql.createConnection({
  host: 'your_host',
  user: 'your_username',
  password: 'your_password',
  database: 'your_database',
  getServerPublicKey: true,
});

This is less secure than SSL/TLS but allows the plugin to complete password exchange.

5Solution 4: Change server-wide default authentication (if you manage the server)

If you control the MySQL server and want to use mysql_native_password globally (not recommended for production, but useful for development), edit the MySQL configuration file:

On Linux/macOS:
Edit /etc/mysql/my.cnf or /usr/local/etc/my.cnf

On Windows:
Edit C:\\ProgramData\\MySQL\\MySQL Server 8.0\\my.ini

Add this under the [mysqld] section:

ini
[mysqld]
default_authentication_plugin=mysql_native_password

Save and restart MySQL:

bash
# Linux
sudo systemctl restart mysql

# macOS
brew services restart mysql

# Windows (command prompt as admin)
net stop MySQL80
net start MySQL80

New user accounts will now use mysql_native_password by default.

6Verify the fix works

Test the connection with your database client:

bash
mysql -u your_username -h your_host -p -e "SELECT 1;"

If you see "1" in the output, the connection is successful. For application-level connections (Node.js, Python, PHP, etc.), test with a simple query to confirm the database is accessible.

Advanced notes

The caching_sha2_password plugin is more secure than mysql_native_password because it uses SHA-256 hashing and includes built-in credential caching on the server side, reducing the computational load. However, it requires either an encrypted connection or RSA public key infrastructure. For development environments, switching to mysql_native_password is acceptable; for production systems handling sensitive data, prefer SSL/TLS connections with caching_sha2_password. Some MySQL distributions built with yaSSL (older Windows/macOS builds) may have restricted SSL support; check with SHOW VARIABLES LIKE 'have_ssl';. If using Docker, ensure your image includes mysql-community-server-plugins; Alpine/minimal images often omit these plugins, causing load failures.

Frequently asked questions

What does "CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error" mean?
Error 2061 (CR_AUTH_PLUGIN_ERR) indicates that MySQL's authentication plugin system failed during the connection handshake. The server chooses a specific authentication method based on the user account configuration, but the client either doesn't support that method, lacks required encryption capabilities, or has outdated authentication libraries. This is a server-side authentication protocol enforcement that prevents the connection from completing.
How do I fix "CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error"?
Error 2061 occurs when the MySQL server selects an authentication plugin (usually caching_sha2_password in MySQL 8.0+) that the client cannot properly execute. Fix by using SSL/TLS, requesting the RSA public key, or changing the authentication plugin.
What causes "CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error"?
MySQL 8.0+ defaults to caching_sha2_password authentication plugin, but your client uses mysql_native_password or has outdated libraries Connection lacks SSL/TLS encryption, forcing the caching_sha2_password plugin to require RSA public key exchange, which fails when the server doesn't send the key Client library is too old to support the caching_sha2_password plugin (common with mysql CLI drivers, Sequelize, or older mysql/mysql2 npm packages)
Is the "CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading