I am a Software Engineer from India. I am currently building Daestro. I work in Rust, Javascript and Python. Zola 2025-09-08T00:00:00+00:00 https://vshukla.com/tags/redis/atom.xml 2025-09-08T00:00:00+00:00 2025-09-08T00:00:00+00:00 Vivek Shukla https://vshukla.com/tech/setup-redis-tls-with-self-signed-certs/

Brief guide on how to setup Redis TLS using Self-signed certificate.

<blockquote> <p>This method is only recommended when connecting to redis server via local network.</p> </blockquote> <h2 id="generate-server-certificates"><a class="zola-anchor" href="#generate-server-certificates" aria-label="Anchor link for: generate-server-certificates">🔗</a>Generate Server Certificates</h2> <p>Generate Cert and Key file for self signed TLS, then move both these files to redis directory and set the proper permissions. Delete the Key file and copy the cert file to the client machine which will connect to the redis-server.</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-support z-function">cd</span><span class="z-string"> ~</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">openssl</span><span class="z-string"> req</span><span class="z-constant z-other"> -x509 -nodes -days</span><span class="z-constant z-numeric"> 3650</span><span class="z-constant z-other"> -newkey</span><span class="z-string"> rsa:2048</span><span class="z-constant z-character"> \</span></span> <span class="giallo-l"><span class="z-constant z-other"> -keyout</span><span class="z-string"> redis_tls.key</span><span class="z-constant z-other"> -out</span><span class="z-string"> redis_tls.crt</span><span class="z-constant z-character"> \</span></span> <span class="giallo-l"><span class="z-constant z-other"> -subj</span><span class="z-string"> &quot;/CN=YourOrg&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> cp redis_tls.key redis_tls.crt /etc/redis/</span><span class="z-punctuation z-separator"> &amp;&amp;</span><span class="z-entity z-name"> rm</span><span class="z-string"> redis_tls.key</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chmod</span><span class="z-constant z-numeric"> 600</span><span class="z-string"> /etc/redis/redis_tls.key</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chmod</span><span class="z-constant z-numeric"> 644</span><span class="z-string"> /etc/redis/redis_tls.crt</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chown redis:redis /etc/redis/redis_tls.key</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chown redis:redis /etc/redis/redis_tls.crt</span></span></code></pre><h2 id="update-redis-configuration-file"><a class="zola-anchor" href="#update-redis-configuration-file" aria-label="Anchor link for: update-redis-configuration-file">🔗</a>Update Redis Configuration File</h2> <p>This command will append the value to <code>redis.conf</code> (redis configuration file). Make sure to update the password.</p> <p>It will disable the non-tls support and enable the tls connection at port <code>6379</code> with previously generated key and cert files.</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee</span><span class="z-constant z-other"> -a</span><span class="z-string"> /etc/redis/redis.conf</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> EOF</span></span> <span class="giallo-l"><span class="z-string">bind * -::*</span></span> <span class="giallo-l"><span class="z-string">port 0</span></span> <span class="giallo-l"><span class="z-string">tls-port 6379</span></span> <span class="giallo-l"><span class="z-string">tls-cert-file /etc/redis/redis_tls.crt</span></span> <span class="giallo-l"><span class="z-string">tls-key-file /etc/redis/redis_tls.key</span></span> <span class="giallo-l"><span class="z-string">tls-auth-clients no</span></span> <span class="giallo-l"><span class="z-string">tls-prefer-server-ciphers yes</span></span> <span class="giallo-l"><span class="z-string">requirepass YOUR_PASSWORD_HERE</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Restart and enable redis</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart redis-server</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl enable redis-server</span></span></code></pre> <p>Check status with</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl status redis-server</span></span></code></pre> <p>If any error then check journal (log)</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> journalctl</span><span class="z-constant z-other"> -u</span><span class="z-string"> redis-server</span><span class="z-constant z-other"> -f</span></span></code></pre><h2 id="add-redis-certificate-to-trusted-ca-store-in-client-machine"><a class="zola-anchor" href="#add-redis-certificate-to-trusted-ca-store-in-client-machine" aria-label="Anchor link for: add-redis-certificate-to-trusted-ca-store-in-client-machine">🔗</a>Add Redis Certificate to Trusted CA Store in Client Machine</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-comment"># Copy your certificate to CA certificates directory</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> mv redis_tls.crt /usr/local/share/ca-certificates/redis_tls.crt</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-comment"># Update CA certificates</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> update-ca-certificates</span></span></code></pre><h2 id="redis-connection-url"><a class="zola-anchor" href="#redis-connection-url" aria-label="Anchor link for: redis-connection-url">🔗</a>Redis Connection URL</h2> <p>Since we want to connect to redis using TLS connection, so the protocol in the url will be <code>rediss</code> (with double “ss”).</p> <pre class="giallo z-code"><code data-lang="plain"><span class="giallo-l"><span>rediss://:&lt;your_password_here&gt;@&lt;redis_server_ip&gt;:6379/0#insecure</span></span></code></pre>