FRANS CAISAR RAMADHAN

Redis server has an option to enable in transit encryption. This capability can help protect your data when it is moving from one location to another. However by the time this article written, by default redis-cli does not have an option to enable TLS connection to the redis-server. So if you install default redis-cli for your distro, you cannot establish connection to redis-server with in transit TLS encryption enabled.

user@127.0.0.1:~# redis-cli --tls
Unrecognized option or bad number of args for: '--tls'

Workaround

In this section we will cover how to enable tls option for redis-cli in Ubuntu 16.04.6 Xenial LTS. Other Ubuntu version usually have similar package name for it’s dependency. Please adjust accordingly if you find any disrepancy in it.

We can compile redis-cli from source and enable tls option using following steps

• Install dependencies

# update package information from repo
sudo apt update
# install build dependencies
sudo apt install -y build-essential pkg-config libssl-dev tcl libjemalloc-dev wget

• Download and extract the redis-cli source file

# download the package
wget http://download.redis.io/redis-stable.tar.gz
# extract the package
tar xvzf redis-stable.tar.gz
# go inside the extracted directory
cd redis-stable

• Build with tls enabled

# remove previously generated build files
make distclean
# build with tls option
make BUILD_TLS=yes

• (optional) Replace default installed redis-cli in $PATH with the one we build

# backup the binary to home directory
mkdir -p ~/redis-cli-backup
sudo mv `which redis-cli` ~/redis-cli-backup
# create symbolic link to the path
sudo ln -s ~/redis-stable/src/redis-cli /usr/bin/redis-cli

• Once completed you can validate the build and connect to redis-server

# validate the redis-cli
redis-cli -h localhost -p 6379 --tls

localhost:6379> INFO SSL
# SSL
ssl_enabled:yes
ssl_current_certificate_not_before_date:Jul 27 00:00:00 2021 GMT
ssl_current_certificate_not_after_date:Aug 25 23:59:59 2022 GMT
ssl_current_certificate_serial:ABCDEFGKKSHDJKAHSD05A15BF008A57002E8

Conclusion

Enable in transit encryption for redis-server could enable end-to-end secure communication between each services that requires access to redis. However, if you use redis-cli as your client, this would require you to do some work to make the client support it. We could possibly also enable at-rest encryption enabled to ensure data stored in the redis-server is secured as well.

Hopefully, in the next release redis-cli come by default with tls option. So we can enable end to end encryption without needing this workaround.