diff --git a/internal/db/models/ns_cluster_dao.go b/internal/db/models/ns_cluster_dao.go
index 44918b32..efee6b83 100644
--- a/internal/db/models/ns_cluster_dao.go
+++ b/internal/db/models/ns_cluster_dao.go
@@ -8,6 +8,8 @@ import (
 	_ "github.com/go-sql-driver/mysql"
 	"github.com/iwind/TeaGo/Tea"
 	"github.com/iwind/TeaGo/dbs"
+	"strconv"
+	"strings"
 )
 
 const (
@@ -307,6 +309,22 @@ func (this *NSClusterDAO) UpdateClusterUDP(tx *dbs.Tx, clusterId int64, udpConfi
 	return this.NotifyUpdate(tx, clusterId)
 }
 
+// CountAllClustersWithSSLPolicyIds 计算使用SSL策略的所有NS集群数量
+func (this *NSClusterDAO) CountAllClustersWithSSLPolicyIds(tx *dbs.Tx, sslPolicyIds []int64) (count int64, err error) {
+	if len(sslPolicyIds) == 0 {
+		return
+	}
+	policyStringIds := []string{}
+	for _, policyId := range sslPolicyIds {
+		policyStringIds = append(policyStringIds, strconv.FormatInt(policyId, 10))
+	}
+	return this.Query(tx).
+		State(NSClusterStateEnabled).
+		Where("(FIND_IN_SET(JSON_EXTRACT(tls, '$.sslPolicyRef.sslPolicyId'), :policyIds)) ").
+		Param("policyIds", strings.Join(policyStringIds, ",")).
+		Count()
+}
+
 // NotifyUpdate 通知更改
 func (this *NSClusterDAO) NotifyUpdate(tx *dbs.Tx, clusterId int64) error {
 	return SharedNodeTaskDAO.CreateClusterTask(tx, nodeconfigs.NodeRoleDNS, clusterId, 0, NSNodeTaskTypeConfigChanged)
diff --git a/internal/rpc/services/nameservers/service_ns_cluster.go b/internal/rpc/services/nameservers/service_ns_cluster.go
index 2eeaa3af..e29408c6 100644
--- a/internal/rpc/services/nameservers/service_ns_cluster.go
+++ b/internal/rpc/services/nameservers/service_ns_cluster.go
@@ -340,3 +340,27 @@ func (this *NSClusterService) UpdateNSClusterUDP(ctx context.Context, req *pb.Up
 
 	return this.Success()
 }
+
+// CountAllNSClustersWithSSLCertId 计算使用某个SSL证书的集群数量
+func (this *NSClusterService) CountAllNSClustersWithSSLCertId(ctx context.Context, req *pb.CountAllNSClustersWithSSLCertIdRequest) (*pb.RPCCountResponse, error) {
+	_, err := this.ValidateAdmin(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var tx = this.NullTx()
+	policyIds, err := models.SharedSSLPolicyDAO.FindAllEnabledPolicyIdsWithCertId(tx, req.SslCertId)
+	if err != nil {
+		return nil, err
+	}
+	if len(policyIds) == 0 {
+		return this.SuccessCount(0)
+	}
+
+	count, err := models.SharedNSClusterDAO.CountAllClustersWithSSLPolicyIds(tx, policyIds)
+	if err != nil {
+		return nil, err
+	}
+
+	return this.SuccessCount(count)
+}