diff --git a/alicloud/resource_alicloud_kvstore_instance.go b/alicloud/resource_alicloud_kvstore_instance.go
index 8fb567c13c60..157d9452e96b 100644
--- a/alicloud/resource_alicloud_kvstore_instance.go
+++ b/alicloud/resource_alicloud_kvstore_instance.go
@@ -270,6 +270,18 @@ func resourceAliCloudKvstoreInstance() *schema.Resource {
 				Computed:     true,
 				ValidateFunc: StringInSlice([]string{"Disable", "Enable", "Update"}, false),
 			},
+			"cert_download_url": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"ssl_expired_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"cert_common_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"secondary_zone_id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -725,6 +737,9 @@ func resourceAliCloudKvstoreInstanceRead(d *schema.ResourceData, meta interface{
 		}
 	} else {
 		d.Set("ssl_enable", describeInstanceSSLObject.SSLEnabled)
+		d.Set("cert_download_url", describeInstanceSSLObject.CertDownloadURL)
+		d.Set("ssl_expired_time", describeInstanceSSLObject.SSLExpiredTime)
+		d.Set("cert_common_name", describeInstanceSSLObject.CertCommonName)
 	}
 
 	var securityIpGroupName string
diff --git a/alicloud/resource_alicloud_kvstore_instance_test.go b/alicloud/resource_alicloud_kvstore_instance_test.go
index eadd23721b7b..e875dedc33a9 100644
--- a/alicloud/resource_alicloud_kvstore_instance_test.go
+++ b/alicloud/resource_alicloud_kvstore_instance_test.go
@@ -629,7 +629,10 @@ func TestAccAliCloudKVStoreRedisInstance_6_0(t *testing.T) {
 				}),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheck(map[string]string{
-						"ssl_enable": "Enable",
+						"ssl_enable":        "Enable",
+						"cert_download_url": CHECKSET,
+						"ssl_expired_time":  CHECKSET,
+						"cert_common_name":  CHECKSET,
 					}),
 				),
 			},
@@ -684,7 +687,10 @@ func TestAccAliCloudKVStoreRedisInstance_6_0(t *testing.T) {
 				}),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheck(map[string]string{
-						"ssl_enable": "Disable",
+						"ssl_enable":        "Disable",
+						"cert_download_url": "",
+						"ssl_expired_time":  "",
+						"cert_common_name":  "",
 					}),
 				),
 			},
@@ -2198,7 +2204,10 @@ func TestAccAliCloudKVStoreRedisInstance_5_0_memory_classic_cluster(t *testing.T
 				}),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheck(map[string]string{
-						"ssl_enable": "Enable",
+						"ssl_enable":        "Enable",
+						"cert_download_url": CHECKSET,
+						"ssl_expired_time":  CHECKSET,
+						"cert_common_name":  CHECKSET,
 					}),
 				),
 			},
@@ -2338,6 +2347,9 @@ func TestAccAliCloudKVStoreRedisInstance_5_0_memory_classic_cluster(t *testing.T
 					testAccCheck(map[string]string{
 						"ssl_enable":                "Disable",
 						"private_connection_prefix": CHECKSET,
+						"cert_download_url":         "",
+						"ssl_expired_time":          "",
+						"cert_common_name":          "",
 					}),
 				),
 			},
diff --git a/alicloud/resource_alicloud_redis_tair_instance.go b/alicloud/resource_alicloud_redis_tair_instance.go
index d3a8aa95aa86..211629d5dea3 100644
--- a/alicloud/resource_alicloud_redis_tair_instance.go
+++ b/alicloud/resource_alicloud_redis_tair_instance.go
@@ -219,6 +219,18 @@ func resourceAliCloudRedisTairInstance() *schema.Resource {
 				Computed:     true,
 				ValidateFunc: StringInSlice([]string{"Disable", "Enable", "Update"}, false),
 			},
+			"cert_download_url": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"ssl_expired_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"cert_common_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"status": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -537,6 +549,15 @@ func resourceAliCloudRedisTairInstanceRead(d *schema.ResourceData, meta interfac
 	if objectRaw["SSLEnabled"] != nil {
 		d.Set("ssl_enabled", objectRaw["SSLEnabled"])
 	}
+	if objectRaw["CertDownloadURL"] != nil {
+		d.Set("cert_download_url", objectRaw["CertDownloadURL"])
+	}
+	if objectRaw["SSLExpiredTime"] != nil {
+		d.Set("ssl_expired_time", objectRaw["SSLExpiredTime"])
+	}
+	if objectRaw["CertCommonName"] != nil {
+		d.Set("cert_common_name", objectRaw["CertCommonName"])
+	}
 	if objectRaw["InstanceId"] != nil {
 		d.Set("tair_instance_id", objectRaw["InstanceId"])
 	}
diff --git a/alicloud/resource_alicloud_redis_tair_instance_test.go b/alicloud/resource_alicloud_redis_tair_instance_test.go
index b380b81f5a49..eb4f4dd7ed45 100644
--- a/alicloud/resource_alicloud_redis_tair_instance_test.go
+++ b/alicloud/resource_alicloud_redis_tair_instance_test.go
@@ -1435,7 +1435,10 @@ func TestAccAliCloudRedisTairInstance_basic6473_raw(t *testing.T) {
 				}),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheck(map[string]string{
-						"ssl_enabled": "Enable",
+						"ssl_enabled":       "Enable",
+						"cert_download_url": CHECKSET,
+						"ssl_expired_time":  CHECKSET,
+						"cert_common_name":  CHECKSET,
 					}),
 				),
 			},
diff --git a/website/docs/r/kvstore_instance.html.markdown b/website/docs/r/kvstore_instance.html.markdown
index 961811d31eb8..d01f2372d0dc 100644
--- a/website/docs/r/kvstore_instance.html.markdown
+++ b/website/docs/r/kvstore_instance.html.markdown
@@ -302,6 +302,9 @@ The following attributes are exported:
 * `qps` - Theoretical maximum QPS value.
 * `connection_domain`- Intranet connection address of the KVStore instance.
 * `status` - The status of KVStore DBInstance.
+* `cert_download_url` - The download URL of the SSL certificate.
+* `ssl_expired_time` - The expiration time of the SSL certificate.
+* `cert_common_name` - The common name (CN) of the SSL certificate.
 
 ## Timeouts
 
diff --git a/website/docs/r/redis_tair_instance.html.markdown b/website/docs/r/redis_tair_instance.html.markdown
index 631c9eaca6ce..daac339320c7 100644
--- a/website/docs/r/redis_tair_instance.html.markdown
+++ b/website/docs/r/redis_tair_instance.html.markdown
@@ -164,6 +164,9 @@ The following attributes are exported:
 * `region_id` - Region Id
 * `status` - The status of the resource
 * `tair_instance_id` - The ID of the resource.
+* `cert_download_url` - The download URL of the SSL certificate.
+* `ssl_expired_time` - The expiration time of the SSL certificate.
+* `cert_common_name` - The common name (CN) of the SSL certificate.
 
 ## Timeouts