{ "schema_version": 2, "id": "operate/oss_and_stack/management/security/encryption", "title": "TLS", "url": "https://redis.io/docs/latest/operate/oss_and_stack/management/security/encryption/", "summary": "Redis TLS support", "aliases": [ "/management/security/encryption/" ], "tags": [ "docs", "operate", "stack", "oss" ], "last_updated": "2026-04-07T16:24:18+01:00", "page_type": "content", "content_hash": "0f8bf7522a31d04921eed102d44ad08f56f5a3290231962122e3c4871541a9a8", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "SSL/TLS is supported by Redis starting with version 6 as an optional feature\nthat needs to be enabled at compile time." }, { "id": "getting-started", "title": "Getting Started", "role": "setup", "text": "" }, { "id": "building", "title": "Building", "role": "content", "text": "To build with TLS support you'll need OpenSSL development libraries (e.g.\n`libssl-dev` on Debian/Ubuntu).\n\nBuild Redis with the following command:\n\n[code example]" }, { "id": "tests", "title": "Tests", "role": "content", "text": "To run Redis test suite with TLS, you'll need TLS support for TCL (i.e.\n`tcl-tls` package on Debian/Ubuntu).\n\n1. Run `./utils/gen-test-certs.sh` to generate a root CA and a server\n certificate.\n\n2. Run `./runtest --tls` or `./runtest-cluster --tls` to run Redis and Redis\n Cluster tests in TLS mode." }, { "id": "running-manually", "title": "Running manually", "role": "content", "text": "To manually run a Redis server with TLS mode (assuming `gen-test-certs.sh` was\ninvoked so sample certificates/keys are available):\n\n ./src/redis-server --tls-port 6379 --port 0 \\\n --tls-cert-file ./tests/tls/redis.crt \\\n --tls-key-file ./tests/tls/redis.key \\\n --tls-ca-cert-file ./tests/tls/ca.crt\n\nTo connect to this Redis server with `redis-cli`:\n\n ./src/redis-cli --tls \\\n --cert ./tests/tls/redis.crt \\\n --key ./tests/tls/redis.key \\\n --cacert ./tests/tls/ca.crt" }, { "id": "certificate-configuration", "title": "Certificate configuration", "role": "content", "text": "In order to support TLS, Redis must be configured with a X.509 certificate and a\nprivate key. In addition, it is necessary to specify a CA certificate bundle\nfile or path to be used as a trusted root when validating certificates. To\nsupport DH based ciphers, a DH params file can also be configured. For example:\n\n[code example]" }, { "id": "tls-listening-port", "title": "TLS listening port", "role": "content", "text": "The `tls-port` configuration directive enables accepting SSL/TLS connections on\nthe specified port. This is **in addition** to listening on `port` for TCP\nconnections, so it is possible to access Redis on different ports using TLS and\nnon-TLS connections simultaneously.\n\nYou may specify `port 0` to disable the non-TLS port completely. To enable only\nTLS on the default Redis port, use:\n\n[code example]" }, { "id": "client-certificate-authentication", "title": "Client certificate authentication", "role": "content", "text": "By default, Redis uses mutual TLS and requires clients to authenticate with a\nvalid certificate (authenticated against trusted root CAs specified by\n`ca-cert-file` or `ca-cert-dir`).\n\nYou may use `tls-auth-clients no` to disable client authentication." }, { "id": "replication", "title": "Replication", "role": "content", "text": "A Redis master server handles connecting clients and replica servers in the same\nway, so the above `tls-port` and `tls-auth-clients` directives apply to\nreplication links as well.\n\nOn the replica server side, it is necessary to specify `tls-replication yes` to\nuse TLS for outgoing connections to the master." }, { "id": "cluster", "title": "Cluster", "role": "content", "text": "When Redis Cluster is used, use `tls-cluster yes` in order to enable TLS for the\ncluster bus and cross-node connections." }, { "id": "sentinel", "title": "Sentinel", "role": "content", "text": "Sentinel inherits its networking configuration from the common Redis\nconfiguration, so all of the above applies to Sentinel as well.\n\nWhen connecting to master servers, Sentinel will use the `tls-replication`\ndirective to determine if a TLS or non-TLS connection is required.\n\nIn addition, the very same `tls-replication` directive will determine whether Sentinel's\nport, that accepts connections from other Sentinels, will support TLS as well. That is,\nSentinel will be configured with `tls-port` if and only if `tls-replication` is enabled." }, { "id": "additional-configuration", "title": "Additional configuration", "role": "content", "text": "Additional TLS configuration is available to control the choice of TLS protocol\nversions, ciphers and cipher suites, etc. Please consult the self documented\n`redis.conf` for more information." }, { "id": "performance-considerations", "title": "Performance considerations", "role": "performance", "text": "TLS adds a layer to the communication stack with overheads due to writing/reading to/from an SSL connection, encryption/decryption and integrity checks. Consequently, using TLS results in a decrease of the achievable throughput per Redis instance (for more information refer to this [discussion](https://github.com/redis/redis/issues/7595))." }, { "id": "limitations", "title": "Limitations", "role": "limits", "text": "Starting with version 8.0, Redis supports I/O threading with TLS." } ], "examples": [ { "id": "building-ex0", "language": "sh", "code": "make BUILD_TLS=yes", "section_id": "building" }, { "id": "certificate-configuration-ex0", "language": "plaintext", "code": "tls-cert-file /path/to/redis.crt\ntls-key-file /path/to/redis.key\ntls-ca-cert-file /path/to/ca.crt\ntls-dh-params-file /path/to/redis.dh", "section_id": "certificate-configuration" }, { "id": "tls-listening-port-ex0", "language": "plaintext", "code": "port 0\ntls-port 6379", "section_id": "tls-listening-port" } ] }