Configure the SSL encryption feature

Choose your approach before you begin

There are two ways to use SSL:

• Force SSL for all connections: When enabled, all client connections to the instance must be encrypted, regardless of which endpoint is used. Non-encrypted connections are rejected, and no CA certificate is required on the client. Requires a VPC instance.

• Encrypt specific connections (internal or public endpoint): SSL is enabled on a chosen endpoint. Clients must present a CA certificate to establish an encrypted connection.

  Note

  Transport Layer Security (TLS) is the direct successor to SSL. In this topic, SSL refers to both TLS and SSL. RDS for SQL Server supports TLS 1.0, TLS 1.1, and TLS 1.2.

How SSL works

When an encrypted connection is established:

1. The RDS instance sends a server certificate (containing the public key) to the client.

2. The client encrypts a symmetric key using that public key.

3. The RDS instance decrypts the symmetric key using the private key.

4. Both sides use the symmetric key to encrypt and decrypt all subsequent data.

Optionally, the client uses the CA certificate to verify the server certificate — confirming the RDS instance's identity and preventing man-in-the-middle attacks.

Prerequisites

Prerequisites apply only when using a custom certificate. Before you begin, make sure:

• Object Storage Service (OSS) is activated. See Activate OSS.

• The ApsaraDB RDS service account is authorized to access your OSS bucket via your Alibaba Cloud account.

• Your custom certificate is in PFX format and uploaded to an OSS bucket. To get started, see Get started with the OSS console. For uploading large files, see Multipart upload. For browser-based uploads, see Common operations.

Limitations

• SSL is not supported for serverless ApsaraDB RDS instances. See Serverless ApsaraDB RDS for SQL Server instances.

• SSL is not supported for connections to the read/write splitting endpoint. See Enable read/write splitting by enabling the read-only routing endpoint.

• When SSL is enabled, the following operations are unavailable: upgrading the major engine version, updating the minor engine version, creating a temporary instance that runs a later major engine version, and migrating the instance across zones. See Update the minor engine version and Create a temporary instance that runs the required SQL Server version.

Usage notes

• Certificate validity: An SSL certificate is valid for one year. Renew it before it expires — expired certificates prevent applications and clients from establishing encrypted connections. See Update the validity period of a certificate.

• Instance restarts: Enabling SSL, disabling SSL, or renewing a certificate triggers an instance restart. The instance is unavailable for a few minutes. Perform these operations during off-peak hours.

• CPU overhead: SSL encryption can significantly increase CPU utilization. Enable SSL only when encryption is required — for example, when connecting over a public endpoint.

Step 1: Enable SSL

1. Log on to the ApsaraDB RDS console and go to the Instances page. Select the region, find the instance, and click the instance ID.

2. In the left-side navigation pane, click Data Security.

3. On the SSL tab, turn on Disabled.

4. In the Configure SSL dialog box, select an encryption method and configure the parameters.

Choose one of the following methods:

Step 2: Download the CA certificate

You can connect to an RDS instance over SSL without a CA certificate, but downloading and using it is recommended. The CA certificate lets your client verify the server certificate during the SSL handshake — confirming the instance's identity and preventing man-in-the-middle attacks.

1. Log on to the ApsaraDB RDS console and go to the Instances page. Select the region, find the instance, and click the instance ID.

2. In the left-side navigation pane, click Data Security.

3. On the SSL tab, click Download CA Certificate.

The downloaded package contains three certificate files:

jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 224
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

Step 3: Configure SSL on your client

After enabling SSL, configure the certificate on your application or client. The following steps use SQL Server Management Studio (SSMS) as an example.

Appendix: Sample code for SSL connections

Python

# -*- coding:utf-8 -*-

import ssl
import pyodbc

# Create an SSL context using the downloaded PEM certificate
context = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH, cafile="D:\ca\ApsaraDB-CA-Chain.pem")

# Connect to the RDS instance
# Replace the placeholders with your actual values:
#   SERVER   - RDS instance connection string
#   DATABASE - database name
#   UID      - username
#   PWD      - password
conn = pyodbc.connect('DRIVER={ODBC Driver 17 for SQL Server};SERVER=rm-2zec********.sqlserver.rds.aliyuncs.com;DATABASE=master;UID=zhttest;PWD=zht****;Encrypt=yes', ssl=context)
cursor = conn.cursor()
cursor.execute('SELECT @@version')

rows = cursor.fetchall()
for row in rows:
    print(row)

conn.close()

C#

using System;
using System.Data.SqlClient;

namespace SqlConnectionSSLExample
{
    class Program
    {
        static void Main(string[] args)
        {
            // Connect to the RDS instance with SSL encryption enabled
            // Replace the placeholders with your actual values:
            //   Data Source     - RDS instance connection string
            //   Initial Catalog - database name
            //   User ID         - username
            //   Password        - password
            string connectionString = "Data Source=rm-2ze********.sqlserver.rds.aliyuncs.com;Initial Catalog=master;User ID=zhttest;Password=zht****;Encrypt=true;";

            using (SqlConnection connection = new SqlConnection(connectionString))
            {
                connection.Open();
                try
                {
                    SqlCommand cmd = new SqlCommand("SELECT @@version", connection);
                    string result = cmd.ExecuteScalar().ToString();
                    Console.WriteLine(result);
                }
                catch (Exception ex)
                {
                    Console.WriteLine($"Error: {ex.Message}");
                }
            }
        }
    }
}

What's next

SELECT session_id, encrypt_option
FROM sys.dm_exec_connections;
GO

API reference

• DescribeDBInstanceSSL

• ModifyDBInstanceSSL

FAQ

What happens if I don't renew an expired SSL certificate? Does my RDS instance fail or become less secure?

The RDS instance continues running normally — no errors occur and no security risks arise. However, applications and clients cannot establish encrypted connections until the certificate is renewed.