Encryption in Transit Add-On

SSL/TLS Encryption in Transit for Redis

The Redis Encrypted Connection add-on enables SSL/TLS encryption for data moving between Redis clients and servers. Secure traffic is configured on port 6380, while the standard unencrypted Redis port 6379 remains available by default for backward compatibility.

In this article

Add-On Installation

The add-on can be installed on Redis nodes only. In the dashboard, open the Add-Ons section for the required Redis database layer and click Install for Redis Encrypted Connection. The add-on is also available from Marketplace.

Redis SSL add-on
Install the Redis Encrypted Connection add-on for the required Redis layer.

Select the target Environment and Node Group(s), then click Install.

Install Redis SSL
Select the Redis environment and node groups for installation.

After about a minute, the environment is configured for SSL/TLS connections.

Redis SSL add-on installed
The Redis layer is configured after successful add-on installation.
Secure port: port 6380 is used for SSL/TLS connections by default and is automatically added to the firewall rules during installation.
Redis SSL firewall
The secure Redis port is automatically added to the firewall configuration.

Add-On Specifics

  • The add-on pre-installs Redli, a Go-based alternative to the standard Redis CLI.
  • Certificates are generated with /usr/local/sbin/selfcertgen.
  • Certificates are self-signed and issued for the hostname of each individual Redis node.
  • Each node has its own certificate set, so use the certificates belonging to the node you access.

Generated certificates are stored under:

/var/lib/jelastic/keys/SSL-TLS
serverContains server-side certificates used to encrypt connections to the Redis database.
clientContains downloadable client certificates that can be used for client authentication.
Redis SSL certificates
Server and client SSL/TLS certificates are stored in the SSL-TLS keys directory.

All add-on-specific Redis settings are stored in:

/etc/redis.conf
Redis SSL configuration file
SSL/TLS-related Redis settings are managed in /etc/redis.conf.
tls-portPort used for SSL/TLS connections. Default: 6380.
portPort accepting unencrypted connections. Default: 6379. Set to 0 to disable unencrypted access.
tls-cert-file / tls-key-file / tls-ca-cert-fileDefine paths to the server-side SSL/TLS certificates.
tls-auth-clientsControls whether valid client certificates are required. The default value is optional.
tls-replication / tls-clusterEnable SSL/TLS for Redis replication or cluster interconnection when required.

Add-On Configuration

After installation, open the add-on from the Redis layer’s Add-Ons tab. Use Re-issue certificates to generate new SSL/TLS certificates. Use Uninstall from the add-on menu when the functionality is no longer required.

Manage Redis SSL add-on
Re-issue certificates or uninstall the Redis encryption add-on.

Secure Connection to Redis

To avoid exposing the Redis password in the command line, store it in REDISCLI_AUTH:

export REDISCLI_AUTH={password}

Connect through TLS on port 6380 using the root certificate:

redis-cli -p 6380 --tls --cacert /var/lib/jelastic/keys/SSL-TLS/client/root.crt {command}
Redis secure connection
Connect to Redis securely with redis-cli and the generated CA certificate.

If client certificate authentication is required, also provide the client certificate and private key:

redis-cli -p 6380 --tls \
--cert /var/lib/jelastic/keys/SSL-TLS/client/client.crt \
--key /var/lib/jelastic/keys/SSL-TLS/client/client.key \
--cacert /var/lib/jelastic/keys/SSL-TLS/client/root.crt {command}
Redis secure connection with client certificates
Use client certificates and the private key when mutual TLS authentication is required.

For external connections, copy client.crt, client.key, and root.crt to the client computer/container/VM and use -h to provide the remote hostname or IP address.

SSL Configuration Examples

Force SSL for Standalone Redis

  1. Set port 0 in /etc/redis.conf to disable unencrypted connections.
  2. Set tls-port 6379.
  3. To require mutual TLS authentication, set tls-auth-clients yes.
  4. Remove the firewall rule for port 6380, because it is no longer used.
  5. Restart the Redis container.

Afterward, Redis accepts only SSL/TLS connections on port 6379.

Cluster / Sentinel Interconnection through SSL

Scaling caution: automatic and manual scaling may work incorrectly after enabling encrypted cluster interconnection because the platform scaling logic is designed for plain non-SSL connections.
  1. For a Redis cluster, set tls-cluster yes.
  2. For Sentinel replication, set tls-replication yes.
  3. Keep tls-auth-clients optional.
  4. Either set tls-port to 6379 or change the cluster/replication interconnection port to 6380.
  5. Restart the Redis cluster.

Multi-Region Cluster SSL Interconnection

A multi-region Redis cluster must use the same root certificate on all nodes in all environments for successful TLS interconnection.

  1. Install the SSL add-on on the first environment.
  2. Copy the root certificate from the first environment’s SSL/TLS directory to the SSL/TLS directories on all nodes in the second and third environments.
  3. Install the SSL add-on on those environments. Existing copied root certificates are then used instead of generating independent root certificates.

Expected Result

Redis accepts encrypted SSL/TLS client connections through port 6380 by default while preserving optional backward-compatible unencrypted access on port 6379. Certificates, client authentication, cluster encryption, and forced-TLS behavior can be managed through the generated certificates and /etc/redis.conf.

Important Notes

  • Secure Redis connections use port 6380 by default.
  • Unencrypted port 6379 remains enabled unless explicitly disabled.
  • Certificates are self-signed and node-specific.
  • Generated certificates are stored in /var/lib/jelastic/keys/SSL-TLS.
  • tls-auth-clients is optional by default.
  • Redis cluster and replication traffic remain unencrypted unless tls-cluster or tls-replication is enabled.
  • Encrypted cluster interconnection can affect automatic and manual scaling.
  • Multi-region clusters require the same root certificate across all participating environments.