Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add TLS support. #123

Closed
wants to merge 1 commit into from
Closed

Add TLS support. #123

wants to merge 1 commit into from

Conversation

bjosv
Copy link
Contributor

@bjosv bjosv commented Apr 27, 2021

This is a continuation of #99 and #103 to attempt to add support of TLS to docker-redis-cluster.
Its basically the same as #103 with some small changes, and the cert files are removed from the PR.

  • When TLS is enabled, the regular TCP port is disabled (binded to port 0) and the configured port is used as a TLS only port.
  • This change has been tested by building all versions (invoke build all, i.e currently 3.0.0 to 6.2.1), and the BUILD_TLS flag only effects Redis 6 and forward.
  • Each built container has been tested OK when connecting using redis-cli both from within the container and from outside container.
  • Enabling TLS using the env. -e TLS=true only works for Redis 6. Older version will not handle the redis-cli flag -tls
  • Since there was problems regarding cert handling pre-6.0.6, TLS only works fine from Redis 6.0.6

This PR requires additional files to be created by the maintainer using the following steps

# Generate Certificate Authority's private key and cert
mkdir -p tls-certs
openssl genrsa -out tls-certs/ca.key 4096
openssl req \
    -x509 -new -nodes -sha256 \
    -key tls-certs/ca.key \
    -days 3650 \
    -subj '/O=Redis Cluster Test/CN=Certificate Authority' \
    -out tls-certs/ca.crt

# Generate Redis Cluster private key and a cert signed by CA
openssl genrsa -out tls-certs/redis.key 2048
openssl req \
    -new -sha256 \
    -key tls-certs/redis.key \
    -subj '/O=Redis Cluster Test/CN=Server' | \
    openssl x509 \
        -req -sha256 \
        -CA tls-certs/ca.crt \
        -CAkey tls-certs/ca.key \
        -CAserial tls-certs/ca.txt \
        -CAcreateserial \
        -days 3650 \
        -out tls-certs/redis.crt

# Adding needed files
git add tls-certs/ca.crt tls-certs/ca.key tls-certs/redis.crt tls-certs/redis.key

@bjosv
Copy link
Contributor Author

bjosv commented Apr 27, 2021

CI fails due to the required files are not existing yet, i.e:
tls-certs/ca.crt tls-certs/ca.key tls-certs/redis.crt tls-certs/redis.key

@bjosv bjosv closed this Oct 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants