Docs

RDS for MySQL

Configuring SSL encryption

Enabling SSL encryption

MySQL provides Secure Sockets Layer (SSL) encryption to improve link security. This topic describes how to enable SSL encryption in the MySQL console.

Background

SSL encryption encrypts network connections at the transport layer, improving the security and integrity of communication data.

Prerequisites

You have created an instance, and the instance is in the Running status.

Precautions

Because enabling SSL encryption increases the network response time of the MySQL service, enable it only when encryption is required, such as when connecting to a MySQL instance via the public network.

Modifying the SSL configuration of an instance will restart the instance. Please proceed with caution.

The Database Workshop currently does not support operations on instances with SSL encryption enabled. If you rely on using the database workbench, please enable this feature with caution.

MySQL 8.4 instances do not support enabling SSL encryption.

Procedure

Log on to the RDS for MySQL console.

In the upper-left corner of the top menu bar, select the project and region for the instance.

tip

If the project of the instance has not been set, the project should be selected as All resources.

On the Instances page, click the target instance name.

On the instance details page, click the Security tab.

On the Security tab, click the SSL tab.

On the right side of the SSL tab, click the state button of the SSL feature.

In the dialog box that appears, set the switch time and click OK. You can enable the feature immediately, within a specific time period, or during the maintenance window.

Execute now: Execute immediately after clicking OK.

Specific time period: Execute in the specific time period. If you select to enable the feature at a Specific time, you need to set the time period for enabling the feature in the window.

tip

Setting the upgrade time period across days is not supported.

The shortest time period is two hours.

Set the upgrade time period within the time frame prompted by the console.

Maintenance window: Execute within the maintenance period set for the instance. If you choose to enable within the Maintenance window, you need to confirm the Maintenance window of the instance.

tip

You can click Edit to modify the maintenance window of the instance. For detailed rules on setting maintenance window, see Configuring maintenance window.

After a task is initiated, you can still modify the instance's maintenance window, but the execution time of the initiated task will not be automatically adjusted with the modification of the maintenance window. If you need to adjust the execution time of a task, you need to manually schedule and adjust it at Task center. For more information about modifying tasks execution time, see Changing the execution time of a task.

Subsequent steps

Download SSL certificate

Updating an SSL certificate

Related API

API	Description
DescribeDBInstanceSSL	Call the DescribeDBInstanceSSL API to query the SSL settings of a specified MySQL instance.
ModifyDBInstanceSSL	Call the ModifyDBInstanceSSL API to modify the SSL settings of a specified MySQL instance.

Last updated: 2026.05.28 15:17:52