All Products
Search

This Product

    VPN Gateway:Create and manage SSL client certificates

    Document Center

    VPN Gateway:Create and manage SSL client certificates

    Last Updated:May 27, 2026

    SSL client certificates authenticate clients and encrypt data for SSL-VPN connections. Only authenticated clients can connect to Alibaba Cloud through SSL-VPN. Download and install the certificate on each client.

    Prerequisites

    An SSL server is created. Create and manage an SSL server.

    Create an SSL client certificate

    1. Log on to the VPN Gateway console.

    2. In the navigation pane on the left, choose Interconnections > VPN > SSL Clients.

    3. In the top navigation bar, select the region of the SSL client.

    4. On the SSL Clients page, click Create SSL Client.

    5. In the Create SSL Client panel, configure the SSL client certificate and click OK.

      Configuration

      Description

      Name

      Enter a name for the SSL client certificate.

      Resource Group

      Select the resource group of the SSL server.

      The SSL client certificate must belong to the same resource group as the SSL server.

      SSL Server

      Select the SSL server to associate with this certificate.

    What to do next

    Download and install the certificate on your client.

    Download an SSL client certificate

    1. Log on to the VPN Gateway console.

    2. In the navigation pane on the left, choose Interconnections > VPN > SSL Clients.

    3. In the top navigation bar, select the region of the SSL client.

    4. On the SSL Clients page, find the SSL client certificate that you want to manage and click Download Certificate in the Actions column.

    Delete an SSL client certificate

    Important

    Deleting an SSL client certificate disconnects all clients connected to the SSL server. To reconnect, clients must re-initiate their SSL-VPN connections.

    For example, if an SSL server has Certificate 1 and Certificate 2, deleting Certificate 1 disconnects all clients using either certificate.

    • Clients that used Certificate 1 must install a different valid certificate and re-initiate an SSL-VPN connection.

    • Clients that used Certificate 2 can reconnect by re-initiating the SSL-VPN connection.

    1. Log on to the VPN Gateway console.

    2. In the navigation pane on the left, choose Interconnections > VPN > SSL Clients.

    3. In the top navigation bar, select the region of the SSL client.

    4. On the SSL Clients page, find the SSL client certificate that you want to delete and click Delete in the Actions column.

    5. In the Are you sure that you want to delete the client certificates? dialog box, review the impact and click Delete.

    Create and manage SSL client certificates by calling API operations

    Create, query, and delete SSL client certificates programmatically using Alibaba Cloud SDK (Recommended), Alibaba Cloud CLI, Terraform, and Resource Orchestration Service. Available API operations: