MySQL "Authentication Plugin caching_sha2_password Cannot Be Loaded" and ER_NOT_SUPPORTED_AUTH_MODE: The Fix for MySQL 8.4 and Amazon RDS

"Authentication plugin 'caching_sha2_password' cannot be loaded" (ERROR 2059) means your MySQL client or driver is too old for the way the server stores this account's password. MySQL 8 servers create new accounts with the caching_sha2_password sign-in method, and clients from before it existed, such as the MySQL 5.6 client or Node.js's old mysql package (which reports ER_NOT_SUPPORTED_AUTH_MODE instead), can't speak it. The real fix is to upgrade the client or driver: in Node.js, switch to mysql2. The quick workaround is to switch that one account back with ALTER USER ... IDENTIFIED WITH mysql_native_password, but that's a dead end: the old method is deprecated, and on Amazon RDS, its support ends with MySQL 8.4. Here's the twist that brings this error back to people who thought they'd never see it: on RDS, MySQL 8.0 creates accounts with the old method and MySQL 8.4 with the new one, so after an upgrade, the accounts you already had keep working and every account you create afterwards fails with the same old client. This page shows which clients fail, both fixes, how to check each account, and the related ERROR 2061 "Authentication requires secure connection" that strikes only after a restart.

Ethan, a developer, upgraded the RDS database behind his friend Jake's phone repair shop from MySQL 8.0 to 8.4. Nothing broke. A week later he created a database account for a new reporting script, and the script couldn't sign in, while the shop's app, using the same driver with its old account, worked fine.

New to these terms? An authentication plugin is the method MySQL uses to check a password at sign-in. Each account has one. mysql_native_password is the old method from MySQL 5; caching_sha2_password is the stronger one MySQL 8 introduced. The client and the server must both know the account's method. Amazon RDS runs MySQL for you, with its own defaults.

What the error means, and when it appears

Here's the error from a MySQL 5.6 client, signing in to a MySQL 8.4 server:

mysql -h shop-db.c1abcdexample.us-east-1.rds.amazonaws.com -u reports -p

ERROR 2059 (HY000): Authentication plugin 'caching_sha2_password' cannot be loaded: /usr/lib/mysql/plugin/caching_sha2_password.so: cannot open shared object file: No such file or directory

The server asked the client to sign in with caching_sha2_password. The client looked for a plugin file to handle it, didn't have one, and gave up. Nothing is wrong with the password or the network. Which method a new account gets depends on the server:

That middle row is why so many RDS users met this error only recently. On RDS for MySQL 8.0, every account used the old method, so old clients worked. Upgrade to 8.4, and the existing accounts keep the method they were created with, while new ones get the new method. That's exactly Ethan's situation: the shop app's old account worked; the new reporting account didn't.

Jake: "So the upgrade changed the rules only for new accounts?"

Ethan: "For new ones only. Which is why it waited a week to bite."

Which clients fail

The error depends entirely on the client and its library. With an account using caching_sha2_password on MySQL 8.4:

The same account with mysql_native_password worked with every client in the table, which is what makes the workaround below tempting. For other languages and tools, the rule is the same: old drivers built against MySQL libraries from before 8.0 fail, and current releases work.

Fix 1, the real one: upgrade the client or driver

Upgrading is the fix that lasts, because it doesn't weaken the account. For the command-line client, install a current one; on Amazon Linux 2023, sudo dnf install -y mariadb1011 gives you a mysql command that handles both methods.

In Node.js, the popular mysql package has never supported caching_sha2_password, and its latest release still fails with this:

ER_NOT_SUPPORTED_AUTH_MODE: Client does not support authentication protocol requested by server; consider upgrading MySQL client

Its successor, mysql2, is largely compatible with the same code. Swap the package and the require line:

npm uninstall mysql
npm install mysql2

const mysql = require("mysql2");

const db = mysql.createConnection({
  host: process.env.DB_HOST,
  user: process.env.DB_USER,
  password: process.env.DB_PASSWORD,
});

db.query("SELECT CURRENT_USER() AS u", (err, rows) => {
  if (err) throw err;
  console.log(rows[0].u);
  db.end();
});

Test your queries after the switch; mysql2 also offers a promise-based interface, require("mysql2/promise"), if you want async/await. Keep the database password out of the code, for example in Secrets Manager, and pass it in as an environment variable as above.

Check which method each account uses

Before changing anything, see which accounts use which method. This works on RDS with the master user:

SELECT user, host, plugin FROM mysql.user WHERE user NOT LIKE 'mysql.%' AND user NOT LIKE 'rds%';

+------------+-----------+-----------------------+
| user       | host      | plugin                |
+------------+-----------+-----------------------+
| app_native | %         | mysql_native_password |
| app_new    | %         | caching_sha2_password |
| root       | %         | caching_sha2_password |
| root       | localhost | caching_sha2_password |
+------------+-----------+-----------------------+

Accounts listed as caching_sha2_password need a current client; accounts listed as mysql_native_password work with old clients too, for now. If one app fails and another works against the same database, compare their accounts here first.

Fix 2, the workaround: switch one account back

If you can't upgrade a client today, you can change the account to the old method:

ALTER USER 'reports'@'%' IDENTIFIED WITH mysql_native_password BY 'the-password';

On RDS for MySQL 8.4, the old method is still available. On a MySQL 8.4 server you run yourself, it's turned off by default, and the statement fails:

ERROR 1524 (HY000) at line 1: Plugin 'mysql_native_password' is not loaded

Turning it on there takes mysql_native_password=ON in the server's configuration and a restart. Even where it works, it leaves a trail: every sign-in with the old method writes a deprecation warning to the server's error log:

[Warning] [MY-013360] [Server] Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

On RDS, support for mysql_native_password ends with MySQL 8.4, so every account you switch back is one you'll have to switch again before the next major version. Use this to unblock a deadline, and put the client upgrade on the list for the same week.

Jake: "So the quick fix comes with a due date?"

Ethan: "A due date and a warning in the log for every sign-in. I used it for one day."

Make new accounts use the old method (if you must)

If many old clients must keep working through a migration, you can change the method new accounts get, instead of fixing them one by one. The setting is authentication_policy; with mysql_native_password as its first value, new accounts use the old method:

SET PERSIST authentication_policy = 'mysql_native_password,,';
CREATE USER 'app_next'@'%' IDENTIFIED BY 'the-password';
SELECT user, plugin FROM mysql.user WHERE user = 'app_next';

+----------+-----------------------+
| user     | plugin                |
+----------+-----------------------+
| app_next | mysql_native_password |
+----------+-----------------------+

That's for a server you run yourself. On RDS for MySQL 8.4, set authentication_policy in a custom DB parameter group attached to the instance; SET PERSIST isn't available to the master user. The default value, *,,, means the server's default, caching_sha2_password. Change it back once your clients are upgraded.

ERROR 2061: "Authentication requires secure connection"

Even a current client can fail with caching_sha2_password when it connects without TLS, and in a way that looks random:

ERROR 2061 (HY000): Authentication plugin 'caching_sha2_password' reported error: Authentication requires secure connection.

The method keeps a cache of recent sign-ins on the server. While an account is in the cache, a connection without TLS signs in fine. After a server restart, a failover or a flush, the cache is empty, and the first sign-in must send the password protected by either TLS or the server's RSA key. A client that has neither fails until someone signs in another way. That's why it "works all day and breaks after maintenance".

Two fixes. The better one is to connect with TLS, which RDS supports for every connection. The other is to let the client fetch the server's RSA key:

mysql -h shop-db.c1abcdexample.us-east-1.rds.amazonaws.com -u reports -p --ssl-mode=DISABLED --get-server-public-key

If your app fails like this only after maintenance windows, work through it in order:

1. Confirm the error number is 2061, not 2059: 2061 means the client supports the method but has no secure way to send the password.
2. Check whether the app's connection uses TLS; many drivers don't unless you ask.
3. Turn TLS on in the driver's settings, and give it the RDS certificate bundle so it can verify the server.
4. If TLS truly isn't possible, enable the driver's option to fetch the server's public key.
5. Test by restarting a test database and connecting before anything else does.

That example disables TLS only to show the option; in practice, keep TLS on and the problem never appears. Drivers have the same choice under different names, such as an option to allow fetching the public key.

Upgrading RDS from MySQL 8.0 to 8.4: a checklist

Because the default changes at 8.4, an RDS upgrade is the right moment to deal with this on your terms:

1. Before the upgrade, list every client and driver that connects, with its version.
2. Upgrade the old ones first, while the database is still on 8.0 and everything works, and test them.
3. After the upgrade, run the account query above. Existing accounts keep their old method; that's expected.
4. Create new accounts with the default method, and connect them with the upgraded clients over TLS.
5. Over time, move old accounts to caching_sha2_password with ALTER USER ... IDENTIFIED WITH caching_sha2_password BY ..., one application at a time.

If an app can't connect at all after the upgrade, and the error isn't about authentication, our RDS connection guide covers the network side, and Lambda functions have their own considerations in our Lambda and RDS guide.

Troubleshooting by symptom

ERROR 2059: Authentication plugin 'caching_sha2_password' cannot be loaded

The client is too old for the account's method. Upgrade the client, or switch the account to mysql_native_password.

ER_NOT_SUPPORTED_AUTH_MODE in Node.js

The mysql package doesn't support caching_sha2_password. Switch to mysql2.

ERROR 1524: Plugin 'mysql_native_password' is not loaded

Self-managed MySQL 8.4 disables the old method. Enable mysql_native_password=ON and restart, or upgrade the client instead.

ERROR 2061: Authentication requires secure connection

The client connects without TLS and the server's cache is empty. Use TLS, or allow fetching the server's public key.

Old app works, new account fails, same driver

The accounts use different methods. Compare them in mysql.user; new RDS 8.4 accounts use caching_sha2_password.

Deprecation warnings fill the MySQL error log

Accounts still sign in with mysql_native_password. Upgrade those clients and move the accounts to caching_sha2_password.

caching_sha2_password: frequently asked questions

Ethan switched the reporting account to the old method for one afternoon, replaced mysql with mysql2 in the script that evening, and switched the account back. Then he did the same for the shop app, so both use the new method. Jake asked whether the upgrade had been a mistake. Ethan's view: "The upgrade was fine. The driver was from 2020."

Revision note. Written October 13, 2026, for MySQL 8.4 and 8.0, including Amazon RDS for MySQL. "You can't teach an old dog new tricks," goes the saying; with old MySQL clients, the answer is a new dog.