All Products
Search

This Product

    Web Application Firewall:ModifyDefaultHttps

    Document Center

    Web Application Firewall:ModifyDefaultHttps

    Last Updated:Aug 10, 2026

    Modifies the default SSL/TLS settings.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-waf:ModifyDefaultHttps

    update

    *All Resource

    *
    • acs:ResourceGroupId
    		 None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    CertId

    string

    Yes

    The ID of the certificate.

    123-cn-hangzhou
    TLSVersion

    string

    Yes

    The TLS version.

    Valid values:

    • tlsv1.1 :

      Supports TLS 1.1 and later. Provides good compatibility and good security.

    • tlsv1.3 :

      Supports only TLS 1.3. Provides the highest security and the lowest compatibility.

    • tlsv1 :

      Supports TLS 1.0 and later. Provides the highest compatibility and the lowest security.

    • tlsv1.2 :

      Supports TLS 1.2 and later. Provides good compatibility and the highest security.

    tlsv1
    CipherSuite

    integer

    No

    The cipher suite type.

    Note

    This parameter is required. You must specify this parameter when you call this operation.

    Valid values:

    • 1 :

      All cipher suites are added.

    • 2 :

      Strong cipher suites are added.

    • 99 :

      Custom cipher suites are added. This value is available only when TLSVersion is not set to tlsv1.3.

    1
    CustomCiphers

    array

    No

    The custom cipher suites to add. This parameter is used only when CipherSuite is set to 99.

    string

    No

    The custom cipher suite.

    Valid values:

    • AES128-SHA :

      The AES128-SHA cipher suite.

    • !SRP :

      The !SRP cipher suite.

    • ECDHE-RSA-AES128-SHA :

      The ECDHE-RSA-AES128-SHA cipher suite.

    • DES-CBC3-SHA :

      The DES-CBC3-SHA cipher suite.

    • ECDHE-ECDSA-AES128-SHA :

      The ECDHE-ECDSA-AES128-SHA cipher suite.

    • AES128-GCM-SHA256 :

      The AES128-GCM-SHA256 cipher suite.

    • ECDHE-ECDSA-AES128-SHA256 :

      The ECDHE-ECDSA-AES128-SHA256 cipher suite.

    • ECDHE-RSA-AES256-SHA384 :

      The ECDHE-RSA-AES256-SHA384 cipher suite.

    • ECDHE-ECDSA-AES256-SHA :

      The ECDHE-ECDSA-AES256-SHA cipher suite.

    • RSA+3DES :

      The RSA+3DES cipher suite.

    • AES256-GCM-SHA384 :

      The AES256-GCM-SHA384 cipher suite.

    • ECDHE-RSA-AES128-GCM-SHA256 :

      The ECDHE-RSA-AES128-GCM-SHA256 cipher suite.

    • AES256-SHA256 :

      The AES256-SHA256 cipher suite.

    • ECDHE-RSA-AES128-SHA256 :

      The ECDHE-RSA-AES128-SHA256 cipher suite.

    • ECDHE-ECDSA-AES256-GCM-SHA384 :

      The ECDHE-ECDSA-AES256-GCM-SHA384 cipher suite.

    • ECDHE-ECDSA-AES256-SHA384 :

      The ECDHE-ECDSA-AES256-SHA384 cipher suite.

    • AES256-SHA :

      The AES256-SHA cipher suite.

    • ECDHE-ECDSA-AES128-GCM-SHA256 :

      The ECDHE-ECDSA-AES128-GCM-SHA256 cipher suite.

    • !kECDH :

      The !kECDH cipher suite.

    • !LOW :

      The !LOW cipher suite.

    • !CAMELLIA :

      The !CAMELLIA cipher suite.

    • AES128-SHA256 :

      The AES128-SHA256 cipher suite.

    • !SEED :

      The !SEED cipher suite.

    • !eNULL :

      The !eNULL cipher suite.

    • !IDEA :

      The !IDEA cipher suite.

    • !aNULL :

      The !aNULL cipher suite.

    • !EXP :

      The !EXP cipher suite.

    • !MD5 :

      The !MD5 cipher suite.

    • ECDHE-RSA-AES256-GCM-SHA384 :

      The ECDHE-RSA-AES256-GCM-SHA384 cipher suite.

    • !DSS :

      The !DSS cipher suite.

    • !PSK :

      The !PSK cipher suite.

    • ECDHE-RSA-AES256-SHA :

      The ECDHE-RSA-AES256-SHA cipher suite.

    ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
    InstanceId

    string

    Yes

    The ID of the WAF instance.

    Note

    You can call DescribeInstance to query the ID of the current WAF instance.

    waf_v2_public_cn-***
    EnableTLSv3

    boolean

    No

    Specifies whether TLS 1.3 is supported. Valid values:

    • true: TLS 1.3 is supported.

    • false: TLS 1.3 is not supported.

    Note

    • This parameter is used only when HttpsPorts is not empty, which indicates that the domain name uses the HTTPS protocol. If TLSVersion is set to tlsv1.3, this value must be true.

    true
    RegionId

    string

    No

    The region where the WAF instance is deployed. Valid values:

    • cn-hangzhou: the Chinese mainland.

    • ap-southeast-1: outside the Chinese mainland.

    cn-hangzhou
    ResourceManagerResourceGroupId

    string

    No

    The ID of the Alibaba Cloud resource group.

    rg-acfm***q

    Response elements

    Element

    Type

    Description

    Example

    object

    RequestId

    string

    The ID of the request. The China mainland is a unique identifier generated by Alibaba Cloud for the request. You can use it to troubleshoot issues.

    276D7566-31C9-4192-9DD1-***

    Examples

    Success response

    JSON format

    {
  "RequestId": "276D7566-31C9-4192-9DD1-***"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 Waf.Pullin.InvalidCertIdentifier Invalid certificate ID, certificate ID:%s. Invalid certificate ID, certificate ID:%s.
    400 Waf.Pullin.CertNotExist Certificate does not exist in SSL Certificate Center, certificate ID:%s.
    400 Waf.Pullin.CertEmptyCN The common name of the certificate is empty, certificate ID:%s.
    400 Waf.Pullin.CertExpired Certificate expired, certificate ID:%s . Certificate expired, certificate ID:%s.
    400 Waf.Pullin.InvalidTLS invalid TLS，TLS:%s .
    400 Waf.Pullin.InvalidEnableTLSv3 invalid EnableTLSv3:%s .
    400 Waf.Pullin.InvalidCipherSuit Invalid CipherSuit,CipherSuit:%s.
    400 Waf.Pullin.InvalidCustomCiphers Invalid InvalidCustomCiphers, CustomCiphers:%s .

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.