TLS encryption in Redis

Introduction

TLS encryption keeps data safe when it moves between your computer and the Redis server. It stops others from seeing or changing your data.

When you connect to a Redis server over the internet and want to keep your data private.

When your Redis server holds sensitive information like passwords or personal details.

When you want to follow security rules that require encrypted connections.

When multiple users access Redis and you want to protect their data from being intercepted.

Syntax

Redis

redis-server --tls-port 6379 \
  --port 0 \
  --tls-cert-file /path/to/server.crt \
  --tls-key-file /path/to/server.key \
  --tls-ca-cert-file /path/to/ca.crt

Use --tls-port to enable TLS on a specific port.

Set --port 0 to disable non-TLS connections for better security.

Examples

This starts Redis with TLS enabled on port 6380 and disables the normal port.

Redis

redis-server --tls-port 6380 --port 0 --tls-cert-file server.crt --tls-key-file server.key --tls-ca-cert-file ca.crt

This connects to a Redis server using TLS with client certificates for authentication.

Redis

redis-cli -h myredis.example.com -p 6380 --tls --cert client.crt --key client.key --cacert ca.crt

Sample Program

This example shows how to start Redis with TLS and connect securely using redis-cli. Then it sets and gets a value.

Redis

# Start Redis server with TLS enabled
redis-server --tls-port 6379 --port 0 --tls-cert-file /etc/redis/server.crt --tls-key-file /etc/redis/server.key --tls-ca-cert-file /etc/redis/ca.crt

# Connect to Redis server using TLS
redis-cli -p 6379 --tls --cacert /etc/redis/ca.crt

# Run a simple command
SET greeting "Hello, TLS!"
GET greeting

Important Notes

Make sure your certificate files are valid and trusted by both server and client.

Disabling the non-TLS port (--port 0) helps prevent accidental unencrypted connections.

Redis 6.0 and later support TLS natively.

Summary

TLS encryption protects data sent between Redis clients and servers.

Enable TLS by configuring Redis server with certificates and using --tls-port.

Use redis-cli --tls to connect securely to a TLS-enabled Redis server.