diff --git a/alicloud/resource_alicloud_db_instance.go b/alicloud/resource_alicloud_db_instance.go
index 6fd3ff7dc778..0584632e9e23 100644
--- a/alicloud/resource_alicloud_db_instance.go
+++ b/alicloud/resource_alicloud_db_instance.go
@@ -394,6 +394,26 @@ func resourceAliCloudDBInstance() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"certificate": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"private_key": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"pass_word": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"db_name": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
 			"encryption_key": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -1101,6 +1121,21 @@ func resourceAliCloudDBInstanceUpdate(d *schema.ResourceData, meta interface{})
 			}
 		}
 
+		if "SQLServer" == d.Get("engine").(string) {
+			if v, ok := d.GetOk("certificate"); ok && v.(string) != "" {
+				request["Certificate"] = v.(string)
+			}
+			if v, ok := d.GetOk("private_key"); ok && v.(string) != "" {
+				request["PrivateKey"] = v.(string)
+			}
+			if v, ok := d.GetOk("pass_word"); ok && v.(string) != "" {
+				request["PassWord"] = v.(string)
+			}
+			if v, ok := d.GetOk("db_name"); ok && v.(string) != "" {
+				request["DBName"] = v.(string)
+			}
+		}
+
 		response, err := client.RpcPost("Rds", "2014-08-15", action, nil, request, false)
 		if err != nil {
 			return WrapErrorf(err, DefaultErrorMsg, d.Id(), action, AlibabaCloudSdkGoERROR)
@@ -1354,6 +1389,19 @@ func resourceAliCloudDBInstanceUpdate(d *schema.ResourceData, meta interface{})
 			}
 		}
 
+		if d.Get("engine").(string) == "SQLServer" {
+			if d.HasChange("certificate") {
+				if v, ok := d.GetOk("certificate"); ok && v.(string) != "" {
+					request["Certificate"] = v.(string)
+				}
+			}
+			if d.HasChange("pass_word") {
+				if v, ok := d.GetOk("pass_word"); ok && v.(string) != "" {
+					request["PassWord"] = v.(string)
+				}
+			}
+		}
+
 		request["ConnectionString"] = instance["ConnectionString"]
 		if d.HasChange("ssl_connection_string") {
 			if v, ok := d.GetOk("ssl_connection_string"); ok && v.(string) != "" {
diff --git a/website/docs/d/db_instances.html.markdown b/website/docs/d/db_instances.html.markdown
index 04d2c1e08257..e147828cc705 100644
--- a/website/docs/d/db_instances.html.markdown
+++ b/website/docs/d/db_instances.html.markdown
@@ -149,4 +149,8 @@ The following attributes are exported in addition to the arguments listed above:
       * `sync_status` - The synchronization status.
       * `data_sync_time` - The time when the secondary instance completed the synchronization of data from the primary instance. The time follows the ISO 8601 standard in the yyyy-MM-ddTHH:mm:ssZ format. The time is displayed in UTC.
       * `node_id` - The ID of the instance.
-      * `region_id` - The region ID of the instance.
\ No newline at end of file
+      * `region_id` - The region ID of the instance.
+  * `private_key` -(Available in 1.274.0+) The private key of the certificate.
+  * `certificate` -(Available in 1.274.0+) The custom certificate.
+  * `pass_word` -(Available in 1.274.0+) The password of the certificate.
+  * `db_name` -(Available in 1.274.0+) The name of the database for which you want to enable TDE.
\ No newline at end of file