I am a Software Engineer from India. I am currently building Daestro. I work in Rust, Javascript and Python. Zola 2025-09-08T00:00:00+00:00 https://vshukla.com/tags/tls/atom.xml 2025-09-08T00:00:00+00:00 2025-09-08T00:00:00+00:00 Vivek Shukla https://vshukla.com/tech/setup-redis-tls-with-self-signed-certs/

Brief guide on how to setup Redis TLS using Self-signed certificate.

<blockquote> <p>This method is only recommended when connecting to redis server via local network.</p> </blockquote> <h2 id="generate-server-certificates"><a class="zola-anchor" href="#generate-server-certificates" aria-label="Anchor link for: generate-server-certificates">🔗</a>Generate Server Certificates</h2> <p>Generate Cert and Key file for self signed TLS, then move both these files to redis directory and set the proper permissions. Delete the Key file and copy the cert file to the client machine which will connect to the redis-server.</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-support z-function">cd</span><span class="z-string"> ~</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">openssl</span><span class="z-string"> req</span><span class="z-constant z-other"> -x509 -nodes -days</span><span class="z-constant z-numeric"> 3650</span><span class="z-constant z-other"> -newkey</span><span class="z-string"> rsa:2048</span><span class="z-constant z-character"> \</span></span> <span class="giallo-l"><span class="z-constant z-other"> -keyout</span><span class="z-string"> redis_tls.key</span><span class="z-constant z-other"> -out</span><span class="z-string"> redis_tls.crt</span><span class="z-constant z-character"> \</span></span> <span class="giallo-l"><span class="z-constant z-other"> -subj</span><span class="z-string"> &quot;/CN=YourOrg&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> cp redis_tls.key redis_tls.crt /etc/redis/</span><span class="z-punctuation z-separator"> &amp;&amp;</span><span class="z-entity z-name"> rm</span><span class="z-string"> redis_tls.key</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chmod</span><span class="z-constant z-numeric"> 600</span><span class="z-string"> /etc/redis/redis_tls.key</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chmod</span><span class="z-constant z-numeric"> 644</span><span class="z-string"> /etc/redis/redis_tls.crt</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chown redis:redis /etc/redis/redis_tls.key</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chown redis:redis /etc/redis/redis_tls.crt</span></span></code></pre><h2 id="update-redis-configuration-file"><a class="zola-anchor" href="#update-redis-configuration-file" aria-label="Anchor link for: update-redis-configuration-file">🔗</a>Update Redis Configuration File</h2> <p>This command will append the value to <code>redis.conf</code> (redis configuration file). Make sure to update the password.</p> <p>It will disable the non-tls support and enable the tls connection at port <code>6379</code> with previously generated key and cert files.</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee</span><span class="z-constant z-other"> -a</span><span class="z-string"> /etc/redis/redis.conf</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> EOF</span></span> <span class="giallo-l"><span class="z-string">bind * -::*</span></span> <span class="giallo-l"><span class="z-string">port 0</span></span> <span class="giallo-l"><span class="z-string">tls-port 6379</span></span> <span class="giallo-l"><span class="z-string">tls-cert-file /etc/redis/redis_tls.crt</span></span> <span class="giallo-l"><span class="z-string">tls-key-file /etc/redis/redis_tls.key</span></span> <span class="giallo-l"><span class="z-string">tls-auth-clients no</span></span> <span class="giallo-l"><span class="z-string">tls-prefer-server-ciphers yes</span></span> <span class="giallo-l"><span class="z-string">requirepass YOUR_PASSWORD_HERE</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Restart and enable redis</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart redis-server</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl enable redis-server</span></span></code></pre> <p>Check status with</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl status redis-server</span></span></code></pre> <p>If any error then check journal (log)</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> journalctl</span><span class="z-constant z-other"> -u</span><span class="z-string"> redis-server</span><span class="z-constant z-other"> -f</span></span></code></pre><h2 id="add-redis-certificate-to-trusted-ca-store-in-client-machine"><a class="zola-anchor" href="#add-redis-certificate-to-trusted-ca-store-in-client-machine" aria-label="Anchor link for: add-redis-certificate-to-trusted-ca-store-in-client-machine">🔗</a>Add Redis Certificate to Trusted CA Store in Client Machine</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-comment"># Copy your certificate to CA certificates directory</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> mv redis_tls.crt /usr/local/share/ca-certificates/redis_tls.crt</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-comment"># Update CA certificates</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> update-ca-certificates</span></span></code></pre><h2 id="redis-connection-url"><a class="zola-anchor" href="#redis-connection-url" aria-label="Anchor link for: redis-connection-url">🔗</a>Redis Connection URL</h2> <p>Since we want to connect to redis using TLS connection, so the protocol in the url will be <code>rediss</code> (with double “ss”).</p> <pre class="giallo z-code"><code data-lang="plain"><span class="giallo-l"><span>rediss://:&lt;your_password_here&gt;@&lt;redis_server_ip&gt;:6379/0#insecure</span></span></code></pre> 2025-09-04T00:00:00+00:00 2025-09-04T00:00:00+00:00 Vivek Shukla https://vshukla.com/snippets/systemd-service-nginx-deployment/

A cheatsheet to deploy Systemd service behind Nginx reverse proxy. This approach is very common and used a lot.

<h2 id="systemd-service"><a class="zola-anchor" href="#systemd-service" aria-label="Anchor link for: systemd-service">🔗</a>Systemd Service</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee /etc/systemd/system/YOUR_SERVICE_NAME.service</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string">[Unit]</span></span> <span class="giallo-l"><span class="z-string">Description=YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-string">After=network.target</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">[Service]</span></span> <span class="giallo-l"><span class="z-string">ExecStart=/executable/location</span></span> <span class="giallo-l"><span class="z-string">WorkingDirectory=/dir/where/program/can/read-write/data</span></span> <span class="giallo-l"><span class="z-string">Restart=on-failure</span></span> <span class="giallo-l"><span class="z-string">RestartSec=5s</span></span> <span class="giallo-l"><span class="z-string">StartLimitIntervalSec=300</span></span> <span class="giallo-l"><span class="z-string">StartLimitBurst=5</span></span> <span class="giallo-l"><span class="z-string">User=ubuntu</span></span> <span class="giallo-l"><span class="z-string">Group=ubuntu</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">[Install]</span></span> <span class="giallo-l"><span class="z-string">WantedBy=multi-user.target</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Start command:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl daemon-reload</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl enable YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl start YOUR_SERVICE_NAME</span></span></code></pre> <p>Other commands:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-comment"># see logs</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> journalctl</span><span class="z-constant z-other"> -u</span><span class="z-string"> YOUR_SERVICE_NAME</span><span class="z-constant z-other"> -f</span></span> <span class="giallo-l"><span class="z-comment"># restart</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-comment"># when service file is updated</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl daemon-reload</span></span></code></pre><h2 id="nginx-reverse-proxy"><a class="zola-anchor" href="#nginx-reverse-proxy" aria-label="Anchor link for: nginx-reverse-proxy">🔗</a>Nginx Reverse Proxy</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee /etc/nginx/sites-available/YOUR_DOMAIN</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string">map $http_upgrade $connection_upgrade {</span></span> <span class="giallo-l"><span class="z-string"> default upgrade;</span></span> <span class="giallo-l"><span class="z-string"> &#39;&#39; close;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">upstream server_list {</span></span> <span class="giallo-l"><span class="z-string"> server localhost:8000;</span></span> <span class="giallo-l"><span class="z-string"> keepalive 32;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">server {</span></span> <span class="giallo-l"><span class="z-string"> listen 80; # IPv4</span></span> <span class="giallo-l"><span class="z-string"> listen [::]:80; # IPv6</span></span> <span class="giallo-l"><span class="z-string"> server_name YOUR_DOMAIN;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Hide server information headers</span></span> <span class="giallo-l"><span class="z-string"> server_tokens off;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Enable gzip compression</span></span> <span class="giallo-l"><span class="z-string"> gzip on;</span></span> <span class="giallo-l"><span class="z-string"> gzip_disable &quot;msie6&quot;;</span></span> <span class="giallo-l"><span class="z-string"> gzip_vary on;</span></span> <span class="giallo-l"><span class="z-string"> gzip_proxied any;</span></span> <span class="giallo-l"><span class="z-string"> gzip_comp_level 6;</span></span> <span class="giallo-l"><span class="z-string"> gzip_buffers 16 8k;</span></span> <span class="giallo-l"><span class="z-string"> gzip_min_length 1024;</span></span> <span class="giallo-l"><span class="z-string"> gzip_types</span></span> <span class="giallo-l"><span class="z-string"> application/atom+xml</span></span> <span class="giallo-l"><span class="z-string"> application/geo+json</span></span> <span class="giallo-l"><span class="z-string"> application/javascript</span></span> <span class="giallo-l"><span class="z-string"> application/x-javascript</span></span> <span class="giallo-l"><span class="z-string"> application/json</span></span> <span class="giallo-l"><span class="z-string"> application/ld+json</span></span> <span class="giallo-l"><span class="z-string"> application/manifest+json</span></span> <span class="giallo-l"><span class="z-string"> application/rdf+xml</span></span> <span class="giallo-l"><span class="z-string"> application/rss+xml</span></span> <span class="giallo-l"><span class="z-string"> application/xhtml+xml</span></span> <span class="giallo-l"><span class="z-string"> application/xml</span></span> <span class="giallo-l"><span class="z-string"> font/eot</span></span> <span class="giallo-l"><span class="z-string"> font/otf</span></span> <span class="giallo-l"><span class="z-string"> font/ttf</span></span> <span class="giallo-l"><span class="z-string"> image/svg+xml</span></span> <span class="giallo-l"><span class="z-string"> text/css</span></span> <span class="giallo-l"><span class="z-string"> text/javascript</span></span> <span class="giallo-l"><span class="z-string"> text/plain</span></span> <span class="giallo-l"><span class="z-string"> text/xml;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Buffer size optimization</span></span> <span class="giallo-l"><span class="z-string"> client_body_buffer_size 32k;</span></span> <span class="giallo-l"><span class="z-string"> client_header_buffer_size 2k;</span></span> <span class="giallo-l"><span class="z-string"> client_max_body_size 10M;</span></span> <span class="giallo-l"><span class="z-string"> large_client_header_buffers 4 2k;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Timeouts</span></span> <span class="giallo-l"><span class="z-string"> client_body_timeout 20;</span></span> <span class="giallo-l"><span class="z-string"> client_header_timeout 20;</span></span> <span class="giallo-l"><span class="z-string"> keepalive_timeout 65;</span></span> <span class="giallo-l"><span class="z-string"> send_timeout 20;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Proxy settings</span></span> <span class="giallo-l"><span class="z-string"> location / {</span></span> <span class="giallo-l"><span class="z-string"> include proxy_params;</span></span> <span class="giallo-l"><span class="z-string"> proxy_set_header Upgrade $http_upgrade;</span></span> <span class="giallo-l"><span class="z-string"> proxy_set_header Connection $connection_upgrade;</span></span> <span class="giallo-l"><span class="z-string"> proxy_redirect off;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffering on;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffer_size 16k;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffers 8 16k;</span></span> <span class="giallo-l"><span class="z-string"> proxy_pass http://server_list;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Additional proxy timeouts</span></span> <span class="giallo-l"><span class="z-string"> proxy_connect_timeout 60s;</span></span> <span class="giallo-l"><span class="z-string"> proxy_send_timeout 120s;</span></span> <span class="giallo-l"><span class="z-string"> proxy_read_timeout 120s;</span></span> <span class="giallo-l"><span class="z-string"> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Security headers</span></span> <span class="giallo-l"><span class="z-string"> add_header X-Content-Type-Options &quot;nosniff&quot; always;</span></span> <span class="giallo-l"><span class="z-string"> add_header Strict-Transport-Security &quot;max-age=31536000; includeSubDomains; preload&quot; always;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Create Symlink</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> ln</span><span class="z-constant z-other"> -s</span><span class="z-string"> /etc/nginx/sites-available/YOUR_DOMAIN /etc/nginx/sites-enabled/</span></span></code></pre> <p>Checks Nginx configuration</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> nginx</span><span class="z-constant z-other"> -t</span></span></code></pre> <p>Restart Nginx</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart nginx</span></span></code></pre><h2 id="letsencrypt-ssl"><a class="zola-anchor" href="#letsencrypt-ssl" aria-label="Anchor link for: letsencrypt-ssl">🔗</a>Letsencrypt SSL</h2> <p>Installing <code>certbot</code> to install TLS certificate</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> apt remove certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> snap install core</span><span class="z-punctuation z-terminator">;</span><span class="z-entity z-name"> sudo</span><span class="z-string"> snap refresh core</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> snap install</span><span class="z-constant z-other"> --classic</span><span class="z-string"> certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> ln</span><span class="z-constant z-other"> -s</span><span class="z-string"> /snap/bin/certbot /usr/bin/certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> certbot</span><span class="z-constant z-other"> --nginx -d</span><span class="z-string"> YOUR_DOMAIN</span></span></code></pre>