Key Management Service:Initialize client

Endpoint

The endpoint is the domain address of your KMS instance's dedicated gateway.

1. Go to the Instances page. Click the Software Key Management or Hardware Key Management tab, then click your KMS instance.

2. In the Basic Information section, copy the value from the Instance VPC Endpoint field.

   

The endpoint follows this format: <instance-id>.cryptoservice.kms.aliyuncs.com.

CA certificate

1. On the Instances page, find the Instance CA Certificate section and click Download.

2. In the Instance CA Certificate dialog box, select the instance ID, click Download, and store the file securely.

The downloaded file is named PrivateKmsCA_kst-******.pem.

Production environment (recommended)

Use this configuration for production deployments. The CA certificate verifies the authenticity of the SSL/TLS certificate, securing communications between your application and the KMS instance.

# -*- coding: utf-8 -*-
import os
from openapi.models import Config
from openapi_util.models import RuntimeOptions
from sdk.client import Client

# Configure the client
config = Config()
# HTTPS is required — the KMS instance service does not allow HTTP.
config.protocol = "https"
# Path to the ClientKey file (clientKey_****.json), downloaded when you created the ClientKey.
config.client_key_file = "<CLIENT_KEY_FILE>"
# ClientKey password, read from an environment variable to avoid hardcoding credentials.
config.password = os.getenv("CLIENT_KEY_PASSWORD")
# Endpoint format: <instance-id>.cryptoservice.kms.aliyuncs.com
config.endpoint = "<ENDPOINT>"

client = Client(config)

# Configure the CA certificate to verify the KMS instance's SSL/TLS certificate.
runtime_options = RuntimeOptions()
runtime_options.verify = "<CA_CERTIFICATE_FILE_PATH>"

Replace the following placeholders:

Set CLIENT_KEY_PASSWORD as an environment variable before running your application:

export CLIENT_KEY_PASSWORD="<your-clientkey-password>"

Offline testing (SSL/TLS verification disabled)

To disable SSL/TLS certificate verification for offline testing, set the IgnoreSSL field in RuntimeOptions to true:

# -*- coding: utf-8 -*-
import os
from openapi.models import Config
from openapi_util.models import RuntimeOptions
from sdk.client import Client

config = Config()
config.protocol = "https"
config.client_key_file = "<CLIENT_KEY_FILE>"
config.password = os.getenv("CLIENT_KEY_PASSWORD")
config.endpoint = "<ENDPOINT>"

client = Client(config)

runtime_options = RuntimeOptions()
# Set IgnoreSSL to true to disable SSL/TLS certificate verification. For offline testing only.
runtime_options.ignore_ssl = True