---
title: "Enable SSL on a DBaaS instance"
description: "Turn on SSL for a MySQL, MariaDB, or PostgreSQL DBaaS instance and download its CA certificate."
content_type: "how-to"
product: "database"
platform: "MyAccount"
url: "/myaccount/database/how-to/enable-ssl-on-a-database/"
topic: ["security-and-access"]
---

# Enable SSL on a DBaaS instance

Turn on SSL to encrypt the connection between your client and a DBaaS instance. You end up with SSL
on and its CA certificate on your machine, ready for your client.

## Before you begin

Check that SSL is still off: a new DBaaS instance has SSL on from the start. If the **CA
Certificate** row on its **DBaaS Details** tab shows **Download**, SSL is on; go to [Download the CA
certificate](#download-the-ca-certificate).

## Turn on SSL

1. From the DBaaS instance's **More Actions** menu, click **Enable SSL**.
2. Click **Confirm**.

SSL is on once the **CA Certificate** row shows **Download**.

## Download the CA certificate

On the DBaaS instance's **DBaaS Details** tab, under **Connection Details**, click **Download** in
the **CA Certificate** row. The file is named `ca-cert.pem`. Point your client at this file to
connect over SSL. In a third-party application, also turn on SSL in its own settings and point it at
this file.

Disk encryption is a separate setting, which secures the data stored on disk; see
[DBaaS encryption and SSL](/myaccount/database/concepts/database-encryption-and-ssl/).

SSL is now on for the DBaaS instance, and you have its CA certificate. Next, connect over SSL; see
[Connect to a DBaaS instance](/myaccount/database/how-to/connect-to-a-database/). A Read Replica
needs SSL on the primary; see
[Create a Read Replica](/myaccount/database/how-to/create-a-read-replica/). If a connection reports
a certificate error, see
[Troubleshooting DBaaS](/myaccount/database/troubleshooting/database/#a-certificate-check-fails-with-does-not-match-host-name-or-certificate-verify-failed).