Use the ModifyDBInstanceSSL API to configure SSL encryption - ApsaraDB RDS - Alibaba Cloud - ApsaraDB RDS

Modifies the SSL configuration of an ApsaraDB RDS instance.

Operation description

Supported DPI engine

ApsaraDB RDS for MySQL
ApsaraDB RDS for PostgreSQL
ApsaraDB RDS for SQL Server

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

rds:ModifyDBInstanceSSL

update

*DBInstance

acs:rds:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}

rds:ResourceTag
rds:SSLEnabled

None

Request parameters

Parameter	Type	Required	Description	Example
DBInstanceId	string	Yes	The instance ID. You can call the DescribeDBInstances operation to query the instance ID.	rm-uf6wjk5****
ConnectionString	string	Yes	The internal or public endpoint for which you want to create or update the server certificate.	rm-uf6wjk5****.mysql.rds.aliyuncs.com
SSLEnabled	integer	No	Specifies whether to enable SSL encryption. Valid values: 1: enabled 0: disabled	1
CAType	string	No	The certificate type for ApsaraDB RDS for MySQL and ApsaraDB RDS for PostgreSQL cloud disk instances. Valid values: aliyun: Alibaba Cloud certificate. This is the default value. custom: custom certificate. Note This parameter is required when SSLEnabled is set to 1.	aliyun
ServerCert	string	No	The content of the server custom certificate for ApsaraDB RDS for MySQL and ApsaraDB RDS for PostgreSQL cloud disk instances. Note This parameter is required when CAType is set to custom.	-----BEGIN CERTIFICATE-----MIID*****QqEP-----END CERTIFICATE-----
ServerKey	string	No	The private key of the server certificate for ApsaraDB RDS for MySQL and ApsaraDB RDS for PostgreSQL cloud disk instances. Note This parameter is required when CAType is set to custom.	-----BEGIN PRIVATE KEY-----MIIE****ihfg==-----END PRIVATE KEY-----
ClientCAEnabled	integer	No	Specifies whether to enable the client certificate authority (CA) public key for ApsaraDB RDS for PostgreSQL cloud disk instances. Valid values: 1: enabled 0: disabled	1
ClientCACert	string	No	The client certificate authorization authority public key for ApsaraDB RDS for PostgreSQL cloud disk instances. Note This parameter is required when ClientCAEnabled is set to 1.	-----BEGIN CERTIFICATE-----MIID*****viXk=-----END CERTIFICATE-----
ClientCrlEnabled	integer	No	Specifies whether to enable the client certificate revocation list (CRL) for ApsaraDB RDS for PostgreSQL cloud disk instances. Valid values: 1: enabled 0: disabled Note This parameter can be configured only when ClientCAEnabled is set to 1.	1
ClientCertRevocationList	string	No	The client revocation certificate file for ApsaraDB RDS for PostgreSQL cloud disk instances. Note This parameter is required when ClientCrlEnabled is set to 1.	-----BEGIN X509 CRL-----MIIB****19mg==-----END X509 CRL-----
ACL	string	No	The authentication method for ApsaraDB RDS for PostgreSQL cloud disk instances. Valid values: cert prefer verify-ca verify-full: supported by ApsaraDB RDS for PostgreSQL 12 and later. Note This parameter can be configured only when ClientCAEnabled is set to 1.	cert
ReplicationACL	string	No	The authentication method for the replication permission of ApsaraDB RDS for PostgreSQL cloud disk instances. Valid values: cert prefer verify-ca verify-full: supported by ApsaraDB RDS for PostgreSQL 12 and later. Note This parameter can be configured only when ClientCAEnabled is set to 1.	cert
ForceEncryption	string	No	The forced SSL encryption switch for ApsaraDB RDS for MySQL, ApsaraDB RDS for PostgreSQL, and ApsaraDB RDS for SQL Server instances. Valid values: 1: enabled 0: disabled	1
TlsVersion	string	No	Specifies the minimum TLS version for ApsaraDB RDS for SQL Server instances. Connections using a version lower than the specified version are rejected. Valid values: 1.0, 1.1, and 1.2. For example, if you select 1.1, the server accepts only client connection requests that use TLS 1.1 or TLS 1.2. Clients that attempt to establish connections by using TLS 1.0 are rejected.	1.1
Certificate	string	No	The content of the custom certificate for ApsaraDB RDS for SQL Server instances. Only the `pfx` certificate format is supported. Public endpoint: `oss-<Region ID>.aliyuncs.com:<Bucket name>:<Certificate file name (with file extension)>` Internal endpoint: `oss-<Region ID>-internal.aliyuncs.com:<Bucket name>:<Certificate file name (with file extension)>`	oss-cn-beijing-internal.aliyuncs.com:zhttest:test.pfx
PassWord	string	No	The password of the custom certificate for ApsaraDB RDS for SQL Server instances.	zht123456

Response elements

Element	Type	Description	Example
	object	The response parameters.
RequestId	string	The request ID.	777C4593-8053-427B-99E2-105593277CAB

Examples

Success response

JSON format

{
  "RequestId": "777C4593-8053-427B-99E2-105593277CAB"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidServerCertOrPrivateKey	Specify server certificate or private key is invalid.	The server certificate type or the private key is invalid.
400	InvalidClientCACert	Specify client ca certificate is invalid.	The client CA certificate is invalid.
400	InvalidClientCrl	Specify client certificate revocation list is invalid.	The client CRL is invalid.
400	InvalidCAType.NotFound	Specify ca type is not found.	The server certificate type is invalid.
400	InvalidACL.NotFound	Specify acl is not found.	The access control type is invalid.
400	InvalidSSLStatus	Specify ssl status is invalid.	The operation failed. The setting of SSL encryption is invalid.
400	IncorrectDBSslStatus	Specified DB SSLStatus does not support this operation.	The specified database SSL status is invalid.
400	InvalidModifyMode.Format	Specified modify mode is not valid.
400	Order.ComboInstanceNotAllowOperate	A package instance is not allowed to operate independently.	A package instance is not allowed to operate independently.
400	Price.PricingPlanResultNotFound	Pricing plan price result not found.	Pricing plan price result not found.
400	Order.NoRealNameAuthentication	You have not passed the real-name authentication and do not meet the purchase conditions. Please log in to the user center for real-name authentication.	You have not passed the real-name authentication and do not meet the purchase conditions. Please log in to the cost and cost for real-name authentication.
400	InsufficientAvailableQuota	Your account quota limit is less than 0, please recharge before trying to purchase.	Your account available limit is less than 0, please recharge before trying to purchase.
400	CommodityServiceCalling.Exception	Failed to call commodity service.	Failed to call commodity service return.
400	RegionDissolvedEOM	Dear customer, Alibaba Cloud plans to optimize and adjust the current region. Cloud services in this region will cease operations. You are currently unable to operate new purchase orders. Thank you for your understanding and support.	Hello, Alibaba Cloud plans to optimize and adjust the current region. Cloud services in this region will stop operating. In order to ensure your business continuity and smooth transition of data migration, you are currently unable to operate new purchase orders. Thank you for your understanding and support.
400	Commodity.InvalidComponent	The module you purchased is not legal, please buy it again.	The module you purchased is not legal, please buy it again.
400	RegionEndTimeDissolvedAustralia	Cloud services in the Australia (Sydney) region will be discontinued. Set the validity date to September 30, 2024 or earlier than September 30, 2024.	Hello customer, this area has been abolished.
400	Price.CommoditySys	Commodity system call exception.	Commodity system call exception.
400	Pay.InsufficientBalance	Insufficient available balance.	Insufficient available balance.
400	Order.PeriodInvalid	There is a problem with the period you selected, please choose again.	There is a problem with the period you selected, please choose again.
400	pay.noCreditCard	Account not bound to credit card.	The account is not bound to a credit card.
400	Order.InstHasUnpaidOrder	There is an unpaid order for the service you have purchased. Please pay or void it before placing the order.	There is an unpaid order for the service you have purchased. Please pay or void it before placing the order.
400	noAvailablePaymentMethod	No payment method is specified for your account. We recommend that you add a payment method.	No payment method has been specified for your account. We recommend that you add a payment method.
400	BasicInfoUncompleted	Your information is incomplete. Complete your information before the operation.	Your basic information is not complete, please complete your basic information before operation.
400	Risk.RiskControlRejection	Your account is abnormal, please contact customer service for details.	Your account is abnormal, please contact customer service for details.
400	Api.NotSupport	Specified api is not supported.	The current interface does not support.
400	ContainForbiddenLabelError	There is a label that prohibits placing orders. Please contact your distributor for assistance.	You cannot place the order because a tag indicates that order placement is prohibited. Contact your distributor.
400	InvalidDBInstanceId.NotFound	The DBInstanceId provided does not exist in records.	The DBInstanceId provided does not exist.
400	InvalidInstanceLevel.DiskType	Specified instance level not support request disk type	The current instance type does not support the specified storage type.
400	InvalidParam	Sepcified wal level Parameter is invalid. There are still logical slots in instance, so it can not be set as replica.	The specified wal_level parameter is invalid. There is still a copy slot in the instance, so it cannot be set to replica.
400	KmsApiError	User secret key invalid.	The user key is invalid.
400	System.SaleValidateFailed	Sales expression validation system error.	A system error occurs when the sales expression is verified.
400	Abs.InvalidAccount.NotFound	account is not found.	The account does not exist.
400	SqlExecuteFailedOrTimeout	sql command execution failed or timed out:%s.	SQL command execution failed or timed out
400	ColdData.EngineVersionNotSupport	The current instance engine version not support coldDataEnabled.	The current instance engine version not support coldDataEnabled.
400	ColdData.MinorVersionNotSupport	The current instance minor version not support coldDataEnabled.	The current instance minor version not support coldDataEnabled.
400	IncorrectTargetClasscode	The current instance type does not support this operation.	This operation is not supported by the instance type.
400	InvalidConnectionString.Duplicate	Specified connection string already exists in the RDS.	The link address name is duplicate. Please reset the connection string.
400	RequiredParam.NotFound	Required input param is not found.	The required parameters are not provided.
400	Parameters.Invalid	Parameter error, please check the parameters.	Parameter error, please check the parameters.
400	BackupPolicyNotSupport	Cold Data won't open with CrossBackup or Flash Backup, please check Backup Policy.	Cold Data won't open with CrossBackup or Flash Backup, please check Backup Policy.
400	InvalideStatus.Format	The instance status does not support this operation.	The current instance status does not support this operation.
400	InvalidReleasedKeepPolicy.Format	Specified Released Keep Policy is not valid.	Specified Released Keep Policy is not valid.
400	InvalidDBInstanceEngineType.Format	the DB instance engine type does not support this operation.	This operation is not supported for the database engine of the instance.
400	Pay.NoCreditCard	No credit cards.	No credit cards.
400	VpcNetworkTypeNotSupport	The vpc network type instance does not support this operation.	The vpc network type instance does not support this operation.
400	MirrorInsExists	Specified DB instance mirror ins already existed.	Specified DB instance mirror ins already existed.
400	UnsupportedClassCode	The specified DB instance class stops selling.	The specified DB instance class stops selling.
400	InvalidBackupSet	The specified database does not exist in the backup set.	The specified database does not exist in the backup set.
400	OrdTCommodityQueryError	Failed to query for product.	Failed to query product.
400	ProductInstanceReleased	The instance has been released. Please check before placing the order.	The instance has been released, please verify and place an order.
400	RegionEndTimeDissolvedIndia	The region is no longer supported.	The region is no longer supported.
400	MinorVersionNotSupport.SSLEnabled	Custins minor version does not support current action.	Custins minor version does not support current action.
400	MinorVersionNotSupport	The current database minor version does not support the operation.	The current instance kernel iteration does not support this operation. You can upgrade the kernel iteration.
500	ExternalFailure	The request processing has failed due to external service failure.	The request processing has failed due to external service failure.
500	RequestMetaDataFailed	The service request failed. Please try again later or contact service personnel.	The service request failed. Please try again later or contact service personnel.
500	InvokeProxyFailure	The request processing has failed due to service failure of rds api.	The request failed to be processed due to an RDS API failure.
403	InvalidClientCrl.Permission	Client ca certificate is set first if need to set client certificate revocation list.	The operation failed due to permission errors. Configure the client CA certificate and try again.
403	InvalidACL.Permission	Client ca certificate is set first if need to set acl.	The operation failed. Configure the client CA certificate and try again.
403	OrderStatus.UnPaid	The specified db instance has unpaid order.	The instance has an unpaid order. Please pay first and try again.
403	InvalidReduceDiskSize	The storage capacity after the scale-down must be larger than the used amount.	The scale-in target capacity cannot be less than the current storage space usage
403	CloudSSDNotSupport	Cloud ssd does not support this operation, please upgrade to essd.	Standard SSDs do not support this operation. Upgrade to ESSDs.
403	InvalidUserOperatorPermission	The user permission does not support this operation.	The user is not authorized to perform this operation.
403	InvalidVswitchId	Specified conn vswitch id is not valid.	The specified VSwitchId is incorrectly formatted or empty.
403	IncorrectMinorVersion	Current engine minor version does not support operations.	This operation is not supported for the current minor engine version.
403	OperationDenied.ZoneResource	There is no available zone for inventory.	There is no available zone for inventory.
403	NotInFlowController	Sorry,no permission.	Sorry,no permission.
403	InvalidKmsKey	Kms key is disabled.	The specified KMS key is disabled.
403	InvalidInstanceLevel.Malformed	Current DB instance level does not support this operation.	The specified database instance type does not support this operation.
403	MaxscaleMinorVersionNotSupport	The Maxscale version used by the instance is too low, please upgrade the Maxscale version first.	The version of the database proxy used by the instance is too low. Upgrade the version of the database proxy first.
403	UnsupportedByBlueGreenDeployment	Operation prohibited due to blue green deployment.	The operation is not allowed because a blue-green deployment exists.
403	GuardDBInstanceNotSupport	Guard instance does not support this operation.	This operation is not supported for disaster recovery instances.
404	Endpoint.NotFound	Specified endpoint is not existed.	The operation failed because the specified endpoint was not found.
404	InvalidClusterKms	The current instance does not authorized to access the Key Management Service.	The instance does not have permissions to access Key Management Service (KMS).
404	Request.NotFound	The requested resource is not available.	The requested resources are unavailable.
404	HostInfo.NotFound	The specified host info is not found.	The specified host information does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.

ApsaraDB RDS:ModifyDBInstanceSSL