You can use the MySQL command-line client to connect to Cloud SQL. Thispage describes how to connect amysql client to your Cloud SQL instance,whether running locally on your client machine, on a Compute Engine VM,or in the Cloud Shell.

Before you begin

Before you can use amysql client to connect to your Cloud SQLinstance, do the following:

• Create a Cloud SQL instance, including configuring the default user.

  See Create instances andSet the password for the default user account.

• Optionally, create a Compute Engine VM instance and then connected to the instance using SSH.

  SeeCreate and start a VM instance,About SSH connections, orConnect to Windows VMs using RDP.

• Determine how you'll connect to your instance.

  For the connection options and how to choose from among them, seeAbout connection options.

Use a MySQL client on a local machine or a Compute Engine VM

Using amysql client to connect to your Cloud SQLinstance involves three high-level tasks:

1. Install the client.
2. Configure access to your Cloud SQL instance.
3. Connect to your Cloud SQL instance.

Install the client

To install themysql client, do the following:

1. Download the MySQL Community Server for your platform from theMySQL Community Server download page.
   The Community Server includes the MySQL client.
2. Install the Community Server, following the directions on the download page.

For more information about installing MySQL, seeInstalling and Upgrading MySQL.

Configure access to your Cloud SQLinstance

To configure access to your instance, do the following:

1. From the client machine or Compute Engine VM instance, useWhat's my IP to see the IP address of the client machine.
2. Copy that IP address.

3. In the Google Cloud console, go to theCloud SQL Instances page.

   Go to Cloud SQL Instances

4. To open theOverview page of an instance, click the instance name.
5. SelectConnections from the SQL navigation menu.
6. Select theNetworking tab.
7. In theAuthorized networks section, clickAdd network and enter the IP address of the machine where the client is installed.Note: The IP address of the instance and themysql client IP address you authorize must be thesame IP version: either IPv4 or IPv6.
8. ClickDone. Then clickSave at the bottom of the page to save your changes.
9. Connect to your instance, eitherusing SSL/TLS orwithout encryption (without using SSL/TLS).

Connect to your Cloud SQL instance withoutencryption

To let you connect without encryption, the instance must haveSSL modeset toALLOW_UNENCRYPTED_AND_ENCRYPTED. In the Google Cloud console,the equivalent configuration isAllow unencrypted network traffic.

For more information about the SSL/TLS configuration of your instance, seeConfigure SSL/TLS certificates.

To connect to your instance, do the following:

1. Confirm that you haveinstalled the client andconfigured access to your instance.
2. Start themysql client:

   mysql--ssl-mode=DISABLED--host=INSTANCE_IP_ADDRESS--user=root--password

3. Enter your password.
4. The mysql prompt appears.

Connect to your Cloud SQL instance using SSL/TLS

To connect to your instance using SSL/TLS and built-in authentication:

Before you begin, confirm that you haveinstalled the client andconfigured access to your instance.

1. Start themysql client:

   mysql--ssl-mode=REQUIRED\--host=INSTANCE_IP_ADDRESS\--user=root--password

   Warning: Don't include the--ssl-mode flag in the command if you are using a MariaDB client to connect to the MySQL instance. Use the client from theMySQL community server instead.
2. Enter the password.
3. At the MySQL prompt, enter the\s command to verify that yourconnection is using SSL/TLS.
4. Look for the output line withSSL:.

   ...SSL:                     Cipher in use is DHE-RSA-AES256-SHA...

   Warning: MySQL client versions prior to 5.7.3 consider the--ssl options as advisory, and silently fall back to unencrypted connections if the server does not accept an encrypted connection. For more information, see Using Encrypted Connections in the MySQL Reference Manual. To avoid this issue, you can configure the instance so that only SSL/TLS connections can connect to it (for more information, seeConfiguring SSL for Instances).

   For information about troubleshooting connection issues, seeDebug connectionissues.

Connect to your Cloud SQL instance using SSL/TLS and client certificate verification

Ifssl_mode on your Cloud SQL instance is configured toTRUSTED_CLIENT_CERTIFICATE_REQUIRED,then you must also provide a verified client identity when you log in.

To connect using SSL/TLS certificates with client verification, you need the following:

• A client public key certificate in aclient-cert.pem file.
• A client private key in aclient-key.pem file.

In addition, to let the client verify the server's identityfor mutual authentication, specify the server certificateserver-ca.pem.

mysql--ssl-mode=VERIFY_CA\--ssl-ca=server-ca.pem\--ssl-cert=client-cert.pem\--ssl-key=client-key.pem\--host=INSTANCE_IP_ADDRESS\--user=root--password

If you do not have a client certificate and a correspondingprivate key, thencreate a new client certificate.

Using the client in the Cloud Shell

What's next

• Learn about configuring an instance with a private IP address.
• Learn about options for connecting to your instance from your application.
• Learn about themysql client.