If the identity of a client can't be verified through a signed TLS certificate issued by a trusted certificate issuer, it should be possible to verify the identity by checking the finger print of the client certificate.

1. Supported finger print hashes:
SHA224, SHA256, SHA384, SHA512. The hash algorithm can be detected by the length of the provided hash string.

2. New TLS option (CREATE USER)

REQUIRE FINGERPRINT HEX_STRING : This option implies REQUIRE X509 and SSL.

3. Example (using a SHA384 hash)

CREATE USER user@host REQUIRE FINGERPRINT X'E7ADDDEBC326C9E216EB6EE99AF7B7846D0A3067DD74642BC78B8993AD49CA43235DD80CD1446802B2F1E40FE1EC620B'