Configure Redis 7 cluster SSL encryption and authentication for production security

Update system packages and install dependencies

Start by updating your package manager and installing required tools for SSL certificate generation and Redis cluster management.

sudo apt update && sudo apt upgrade -y
sudo apt install -y redis-server redis-tools openssl wget curl

sudo dnf update -y
sudo dnf install -y redis redis-tools openssl wget curl

Create SSL certificate directory structure

Set up dedicated directories for SSL certificates with proper permissions for Redis cluster security.

sudo mkdir -p /etc/redis/ssl/ca
sudo mkdir -p /etc/redis/ssl/certs
sudo mkdir -p /etc/redis/ssl/private
sudo chmod 755 /etc/redis/ssl
sudo chmod 700 /etc/redis/ssl/private

Generate Certificate Authority (CA) for cluster

Create a private CA to sign certificates for Redis cluster nodes and clients. This establishes trust between all cluster components.

cd /etc/redis/ssl/ca
sudo openssl genrsa -out redis-ca-key.pem 4096
sudo openssl req -new -x509 -days 365 -key redis-ca-key.pem -out redis-ca-cert.pem -subj "/C=US/ST=State/L=City/O=Organization/OU=IT/CN=Redis-CA"

Generate server certificates for cluster nodes

Create individual SSL certificates for each Redis cluster node. Replace the IP addresses with your actual Redis cluster node IPs.

cd /etc/redis/ssl
Generate server private key
sudo openssl genrsa -out private/redis-server-key.pem 2048

Create certificate signing request
sudo openssl req -new -key private/redis-server-key.pem -out redis-server.csr -subj "/C=US/ST=State/L=City/O=Organization/OU=IT/CN=redis-cluster"

Create certificate with SAN for cluster IPs
sudo tee server-cert-config.conf > /dev/null << 'EOF'
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req

[req_distinguished_name]

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = redis-cluster
IP.1 = 127.0.0.1
IP.2 = 203.0.113.10
IP.3 = 203.0.113.11
IP.4 = 203.0.113.12
EOF

Sign the certificate
sudo openssl x509 -req -in redis-server.csr -CA ca/redis-ca-cert.pem -CAkey ca/redis-ca-key.pem -CAcreateserial -out certs/redis-server-cert.pem -days 365 -extensions v3_req -extfile server-cert-config.conf

Generate client certificates for authentication

Create client certificates for secure authentication to the Redis cluster. These will be used by applications and Redis CLI tools.

# Generate client private key
sudo openssl genrsa -out private/redis-client-key.pem 2048

Create client certificate signing request
sudo openssl req -new -key private/redis-client-key.pem -out redis-client.csr -subj "/C=US/ST=State/L=City/O=Organization/OU=IT/CN=redis-client"

Sign client certificate
sudo openssl x509 -req -in redis-client.csr -CA ca/redis-ca-cert.pem -CAkey ca/redis-ca-key.pem -CAcreateserial -out certs/redis-client-cert.pem -days 365

Clean up CSR files
sudo rm redis-server.csr redis-client.csr server-cert-config.conf

Set proper SSL certificate ownership and permissions

Configure secure file permissions for SSL certificates. Redis user needs read access to certificates but private keys must be protected.

sudo chown -R redis:redis /etc/redis/ssl
sudo chmod 644 /etc/redis/ssl/ca/redis-ca-cert.pem
sudo chmod 644 /etc/redis/ssl/certs/*.pem
sudo chmod 600 /etc/redis/ssl/private/*.pem
sudo chmod 600 /etc/redis/ssl/ca/redis-ca-key.pem

Configure Redis cluster authentication

Create a strong password for Redis cluster authentication. This will be used for both cluster communication and client connections.

# Generate strong password for Redis authentication
REDIS_PASSWORD=$(openssl rand -base64 32)
echo "Generated Redis password: $REDIS_PASSWORD"

Store password securely for later use
echo "$REDIS_PASSWORD" | sudo tee /etc/redis/redis-auth-password > /dev/null
sudo chmod 600 /etc/redis/redis-auth-password
sudo chown redis:redis /etc/redis/redis-auth-password

Configure first Redis cluster node

Set up the primary Redis configuration with SSL encryption, authentication, and cluster settings. This will serve as the template for other nodes.

# Network and cluster configuration
port 0
tls-port 6380
bind 0.0.0.0
protected-mode yes
cluster-enabled yes
cluster-config-file nodes-6380.conf
cluster-node-timeout 5000
cluster-announce-port 6380
cluster-announce-bus-port 16380

SSL/TLS configuration
tls-cert-file /etc/redis/ssl/certs/redis-server-cert.pem
tls-key-file /etc/redis/ssl/private/redis-server-key.pem
tls-ca-cert-file /etc/redis/ssl/ca/redis-ca-cert.pem
tls-dh-params-file /etc/redis/ssl/redis-dh.pem

SSL security settings
tls-protocols "TLSv1.2 TLSv1.3"
tls-ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256"
tls-ciphersuites "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256"
tls-prefer-server-ciphers yes
tls-session-caching no
tls-session-cache-size 5000
tls-session-cache-timeout 60

Client authentication
tls-auth-clients yes
tls-cluster yes

Authentication
requirepass REPLACE_WITH_PASSWORD
masterauth REPLACE_WITH_PASSWORD

Security settings
tcp-keepalive 300
timeout 0
maxclients 10000

Persistence
save 900 1
save 300 10
save 60 10000
dir /var/lib/redis
dbfilename dump-6380.rdb
appendonly yes
appendfilename "appendonly-6380.aof"
appendfsync everysec

Logging
loglevel notice
logfile /var/log/redis/redis-server-6380.log
syslog-enabled yes
syslog-ident redis-6380

Generate Diffie-Hellman parameters for SSL

Create strong DH parameters for SSL key exchange. This improves the security of TLS connections to the Redis cluster.

sudo openssl dhparam -out /etc/redis/ssl/redis-dh.pem 2048
sudo chown redis:redis /etc/redis/ssl/redis-dh.pem
sudo chmod 644 /etc/redis/ssl/redis-dh.pem

Apply authentication password to configuration

Replace the password placeholder in the Redis configuration with the generated strong password.

REDIS_PASSWORD=$(cat /etc/redis/redis-auth-password)
sudo sed -i "s/REPLACE_WITH_PASSWORD/$REDIS_PASSWORD/g" /etc/redis/redis-node-1.conf

Set proper ownership and permissions
sudo chown redis:redis /etc/redis/redis-node-1.conf
sudo chmod 640 /etc/redis/redis-node-1.conf

Create systemd service for first cluster node

Set up a dedicated systemd service for the first Redis cluster node with proper security settings and resource limits.

[Unit]
Description=Redis Cluster Node 6380
After=network.target
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
ExecStart=/usr/bin/redis-server /etc/redis/redis-node-1.conf
TimeoutStopSec=0
Restart=always
User=redis
Group=redis

Security settings
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/lib/redis /var/log/redis

Resource limits
LimitNOFILE=65535
MemoryAccounting=true
MemoryMax=2G

[Install]
WantedBy=multi-user.target

Create additional cluster node configurations

Set up configurations for additional cluster nodes on different ports. This example creates two more nodes for a minimal 3-node cluster.

# Create second node configuration
sudo cp /etc/redis/redis-node-1.conf /etc/redis/redis-node-2.conf
sudo sed -i 's/6380/6381/g' /etc/redis/redis-node-2.conf
sudo sed -i 's/16380/16381/g' /etc/redis/redis-node-2.conf
sudo sed -i 's/nodes-6380.conf/nodes-6381.conf/g' /etc/redis/redis-node-2.conf
sudo sed -i 's/dump-6380.rdb/dump-6381.rdb/g' /etc/redis/redis-node-2.conf
sudo sed -i 's/appendonly-6380.aof/appendonly-6381.aof/g' /etc/redis/redis-node-2.conf
sudo sed -i 's/redis-server-6380.log/redis-server-6381.log/g' /etc/redis/redis-node-2.conf
sudo sed -i 's/redis-6380/redis-6381/g' /etc/redis/redis-node-2.conf

Create third node configuration
sudo cp /etc/redis/redis-node-1.conf /etc/redis/redis-node-3.conf
sudo sed -i 's/6380/6382/g' /etc/redis/redis-node-3.conf
sudo sed -i 's/16380/16382/g' /etc/redis/redis-node-3.conf
sudo sed -i 's/nodes-6380.conf/nodes-6382.conf/g' /etc/redis/redis-node-3.conf
sudo sed -i 's/dump-6380.rdb/dump-6382.rdb/g' /etc/redis/redis-node-3.conf
sudo sed -i 's/appendonly-6380.aof/appendonly-6382.aof/g' /etc/redis/redis-node-3.conf
sudo sed -i 's/redis-server-6380.log/redis-server-6381.log/g' /etc/redis/redis-node-3.conf
sudo sed -i 's/redis-6380/redis-6382/g' /etc/redis/redis-node-3.conf

Create systemd services for additional nodes

Set up systemd services for the remaining cluster nodes with the same security settings.

# Create service for second node
sudo cp /etc/systemd/system/redis-cluster-6380.service /etc/systemd/system/redis-cluster-6381.service
sudo sed -i 's/6380/6381/g' /etc/systemd/system/redis-cluster-6381.service
sudo sed -i 's/redis-node-1.conf/redis-node-2.conf/g' /etc/systemd/system/redis-cluster-6381.service

Create service for third node
sudo cp /etc/systemd/system/redis-cluster-6380.service /etc/systemd/system/redis-cluster-6382.service
sudo sed -i 's/6380/6382/g' /etc/systemd/system/redis-cluster-6382.service
sudo sed -i 's/redis-node-1.conf/redis-node-3.conf/g' /etc/systemd/system/redis-cluster-6382.service

Create Redis data and log directories

Set up proper directories for Redis data files and logs with correct ownership and permissions.

sudo mkdir -p /var/lib/redis /var/log/redis
sudo chown redis:redis /var/lib/redis /var/log/redis
sudo chmod 755 /var/lib/redis /var/log/redis

Enable and start all cluster services
sudo systemctl daemon-reload
sudo systemctl enable redis-cluster-6380 redis-cluster-6381 redis-cluster-6382
sudo systemctl start redis-cluster-6380 redis-cluster-6381 redis-cluster-6382

Initialize Redis cluster with SSL

Create the Redis cluster using redis-cli with SSL authentication. This establishes the cluster topology and enables distributed operation.

REDIS_PASSWORD=$(cat /etc/redis/redis-auth-password)

Initialize cluster with SSL
redis-cli --tls \
  --cert /etc/redis/ssl/certs/redis-client-cert.pem \
  --key /etc/redis/ssl/private/redis-client-key.pem \
  --cacert /etc/redis/ssl/ca/redis-ca-cert.pem \
  --cluster create 127.0.0.1:6380 127.0.0.1:6381 127.0.0.1:6382 \
  --cluster-replicas 0 \
  -a $REDIS_PASSWORD \
  --cluster-yes

Configure Redis CLI for SSL connections

Set up a Redis CLI configuration file to simplify SSL connections to the cluster with authentication.

# Redis CLI SSL Configuration
tls-cert-file /etc/redis/ssl/certs/redis-client-cert.pem
tls-key-file /etc/redis/ssl/private/redis-client-key.pem
tls-ca-cert-file /etc/redis/ssl/ca/redis-ca-cert.pem
tls
port 6380

sudo chown redis:redis /etc/redis/redis-cli.conf
sudo chmod 644 /etc/redis/redis-cli.conf

Set up client authentication script

Create a helper script for connecting to the Redis cluster with SSL and authentication for easier administration.

#!/bin/bash
Redis Cluster SSL Connection Script

REDIS_PASSWORD=$(cat /etc/redis/redis-auth-password 2>/dev/null)
SSL_DIR="/etc/redis/ssl"

if [ -z "$REDIS_PASSWORD" ]; then
    echo "Error: Redis password not found"
    exit 1
fi

Connect to cluster with SSL and auth
exec redis-cli --tls \
  --cert "$SSL_DIR/certs/redis-client-cert.pem" \
  --key "$SSL_DIR/private/redis-client-key.pem" \
  --cacert "$SSL_DIR/ca/redis-ca-cert.pem" \
  -c \
  -h 127.0.0.1 \
  -p 6380 \
  -a "$REDIS_PASSWORD" \
  "$@"

sudo chmod +x /usr/local/bin/redis-cluster-cli

Create SSL certificate monitoring script

Monitor SSL certificate expiration to ensure continuous security and prevent connection failures.

#!/bin/bash
Redis SSL Certificate Monitoring Script

SSL_DIR="/etc/redis/ssl"
WARN_DAYS=30
CRIT_DAYS=7

Check certificate expiration
check_cert() {
    local cert_file="$1"
    local cert_name="$2"
    
    if [ ! -f "$cert_file" ]; then
        echo "ERROR: Certificate $cert_name not found at $cert_file"
        return 1
    fi
    
    local exp_date=$(openssl x509 -enddate -noout -in "$cert_file" | cut -d= -f2)
    local exp_epoch=$(date -d "$exp_date" +%s)
    local now_epoch=$(date +%s)
    local days_left=$(( (exp_epoch - now_epoch) / 86400 ))
    
    if [ $days_left -lt $CRIT_DAYS ]; then
        echo "CRITICAL: $cert_name expires in $days_left days"
        return 2
    elif [ $days_left -lt $WARN_DAYS ]; then
        echo "WARNING: $cert_name expires in $days_left days"
        return 1
    else
        echo "OK: $cert_name expires in $days_left days"
        return 0
    fi
}

Check all certificates
echo "Redis SSL Certificate Status:"
check_cert "$SSL_DIR/ca/redis-ca-cert.pem" "CA Certificate"
check_cert "$SSL_DIR/certs/redis-server-cert.pem" "Server Certificate"
check_cert "$SSL_DIR/certs/redis-client-cert.pem" "Client Certificate"

Test cluster connectivity
echo "\nCluster Connectivity Test:"
REDIS_PASSWORD=$(cat /etc/redis/redis-auth-password 2>/dev/null)
if redis-cli --tls --cert "$SSL_DIR/certs/redis-client-cert.pem" --key "$SSL_DIR/private/redis-client-key.pem" --cacert "$SSL_DIR/ca/redis-ca-cert.pem" -h 127.0.0.1 -p 6380 -a "$REDIS_PASSWORD" ping > /dev/null 2>&1; then
    echo "OK: Redis cluster SSL connectivity working"
else
    echo "ERROR: Redis cluster SSL connectivity failed"
fi

sudo chmod +x /usr/local/bin/redis-ssl-monitor
sudo /usr/local/bin/redis-ssl-monitor

Set up automated certificate renewal

Create a systemd timer for regular SSL certificate monitoring and renewal planning.

[Unit]
Description=Redis SSL Certificate Monitor
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/redis-ssl-monitor
User=redis
Group=redis

[Unit]
Description=Redis SSL Certificate Monitor Timer
Requires=redis-ssl-monitor.service

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable --now redis-ssl-monitor.timer