diff --git a/script/impl/upgrade/UpgradeImpl.py b/script/impl/upgrade/UpgradeImpl.py
index 00844da9f386b5baf763c63e0000a16df6c6bf4f..ff50795024ea2308cbaa9483133fa37a4899feae 100644
--- a/script/impl/upgrade/UpgradeImpl.py
+++ b/script/impl/upgrade/UpgradeImpl.py
@@ -4029,8 +4029,6 @@ class UpgradeImpl:
             self.recordDualClusterStage(self.newCommitId, DualClusterStage.STEP_UPGRADE_COMMIT)
 
             self.setActionFile()
-            # turn on enable_ssl for CM
-            self.set_enable_ssl("on")
             if self.context.action == const.ACTION_LARGE_UPGRADE:
                 if DefaultValue.get_cm_server_num_from_static(self.context.clusterInfo) > 0:
                     self.setUpgradeFromParam(const.UPGRADE_UNSET_NUM)
@@ -4039,6 +4037,8 @@ class UpgradeImpl:
                 if "dual-standby" not in self.context.clusterType:
                     self.setUpgradeMode(0)
             time.sleep(10)
+            # turn on enable_ssl for CM
+            self.set_enable_ssl("on")
             if self.dropPMKSchema() != 0:
                 raise Exception(ErrorCode.GAUSS_529["GAUSS_52917"])