{
  "schema_version": 2,
  "id": "operate/rs/security/certificates/create-certificates",
  "title": "Create certificates",
  "url": "https://redis.io/docs/latest/operate/rs/security/certificates/create-certificates/",
  "summary": "Create self-signed certificates to install on a Redis Software cluster.",
  "tags": [
    "docs",
    "operate",
    "rs"
  ],
  "last_updated": "2026-09-24T09:16:28+01:00",
  "page_type": "content",
  "content_hash": "ffd6340125ab4472e0eb11a00bb2a494a4e780fa555556a9d7020d3c32d3fbbb",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "When you first install Redis Software, self-signed certificates are created to enable encryption for Redis Software endpoints.  These certificates expire after a year (365 days) and must be renewed.\n\nYou can renew these certificates by replacing them with new self-signed certificates or by replacing them with certificates signed by a [certificate authority](https://en.wikipedia.org/wiki/Certificate_authority) (CA)."
    },
    {
      "id": "renew-self-signed-certificates",
      "title": "Renew self-signed certificates",
      "role": "content",
      "text": "As of [v6.2.18-70](https://redis.io/docs/latest/operate/rs/release-notes/rs-6-2-18-releases/rs-6-2-18-70), Redis Software includes a script to generate self-signed certificates.  \n\nBy default, the `generate_self_signed_certs.sh` script is located in `/opt/redislabs/utils/`.  \n\nHere, you learn how to use this script to generate new certificates and how to install them."
    },
    {
      "id": "generate-self-signed-certs-script-options",
      "title": "Generate self-signed certs script options",
      "role": "content",
      "text": "You can run the `generate_self_signed_certs.sh` script with the following options:\n\n| Option | Description |\n|----------|-------------|\n| `-h`<br />`--help` | Displays usage instructions. (Optional) |\n| `-d <days>`<br />`--days <days>` | Number of days the self-signed certificate is valid for. Setting this field longer than a year (365 days) is not recommended. (Optional, default: 365) |\n| `-f <names>`<br /><nobr>`--fqdnNames <names>`</nobr> | Space-separated list of [fully qualified domain names (FQDNs)](https://en.wikipedia.org/wiki/Fully_qualified_domain_name). Used for [Subject Alternative Names (SANs)](https://en.wikipedia.org/wiki/Public_key_certificate#Subject_Alternative_Name_certificate). (Required)<br />Example: `-f \"redis.example.com redis-1.example.com\"` |\n| `-t <type>`<br />`--type <type>` | Type of certificate to generate. (Optional, default: all) <br />Values:<br />**cm**: Cluster Manager UI certificate<br />**api**: REST API certificate<br /> **proxy**: database endpoint proxy certificate<br />**syncer**: syncer component certificate<br />**metrics**: metrics exporter certificate<br />**all**: generates all certificate types |"
    },
    {
      "id": "step-1-generate-new-certificates",
      "title": "Step 1: Generate new certificates",
      "role": "content",
      "text": "Sign in to the machine hosting the cluster's master node and then run the following command:\n\n[code example]\n\nWhen you run the script, it either reports success (`\"Self signed cert generated successfully\"`) or an error message. Use the error message to troubleshoot any issues.\n\nThe following example generates all self signed certificates for `mycluster.example.com`; these certificates expire one year after the command is run:\n\n[code example]\n\nSuppose you want to create a Cluster Manager UI certificate to support two clusters for a period of two years.  The following example shows how:\n\n[code example]\n\nHere, a certificate file and certificate key are generated to support the following domains:\n\n[code example]"
    },
    {
      "id": "step-2-locate-the-new-certificate-files",
      "title": "Step 2: Locate the new certificate files",
      "role": "content",
      "text": "When successful, the script generates two .PEM files for each generated certificate: a certificate file and a certificate key, each named after the type of certificate generated (see earlier table for individual certificate names.)\n\nThese files can be found in the `/tmp` directory.\n\n[code example]"
    },
    {
      "id": "step-3-set-permissions",
      "title": "Step 3: Set permissions",
      "role": "content",
      "text": "We recommend setting the permissions of your new certificate files to limit read and write access to the file owner and to set group and other user permissions to read access.\n\n[code example]"
    },
    {
      "id": "replace-self-signed",
      "title": "Step 4: Replace existing certificates",
      "role": "content",
      "text": "You can use `rladmin` to replace the existing certificates with new certificates:\n\n[code example]\n\nThe following values are supported for the _\\<CertName>_ parameter:\n\n| Value | Description |\n|-------|-------------|\n| `api` | The REST API |\n| `cm` | The Cluster Manager UI |\n| `metrics_exporter` | The metrics exporter |\n| `proxy` | The database endpoint |\n| `syncer` | The synchronization process |\n\nYou can also use the REST API.  To learn more, see [Update certificates](https://redis.io/docs/latest/operate/rs/security/certificates/updating-certificates#how-to-update-certificates)."
    },
    {
      "id": "create-ca-signed-certificates",
      "title": "Create CA-signed certificates",
      "role": "content",
      "text": "You can use certificates signed by a [certificate authority](https://en.wikipedia.org/wiki/Certificate_authority) (CA) for Redis Software cluster security.\n\nFor best results, use the following guidelines to create the certificates."
    },
    {
      "id": "certificate-requirements",
      "title": "Certificate requirements",
      "role": "content",
      "text": "- Certificates must include both of the following in the extended key usage extension:\n\n    - TLS Web Server Authentication (OID: 1.3.6.1.5.5.7.3.1)\n\n    - TLS Web Client Authentication (OID: 1.3.6.1.5.5.7.3.2)\n\n    > [!WARNING]\n    > Using certificate templates that only include Server Authentication will cause SSL and TLS errors.\n    >     \n\n- Include the full certificate chain when creating certificate .PEM files. List certificates in order from leaf to root. Some deployments may not require the root CA in the certificate file.\n\n    [code example]\n\n- The Subject Alternative Name (SAN) extension must include the following DNS entries based on your cluster's fully qualified domain name (FQDN):\n\n    [code example]\n\n    For example, if the cluster FQDN is `redis.example.com`, the DNS entries include:\n\n    [code example]\n\n- The key usage extension must include:\n\n    - Digital Signature\n    \n    - Key Encipherment\n\n- Use the cluster's fully qualified domain name (FQDN) for the Common Name (CN).\n\n- Use SHA-256 or SHA-512 for the signature algorithm.\n\n    > [!NOTE]\n    > SHA-1 is deprecated and may be blocked by some operating systems.\n    >     \n\n- The minimum RSA key size is 2048 bits. 4096 bits is recommended for enhanced security.\n\n- A validity period of 1 year or less is recommended."
    },
    {
      "id": "create-certificates-with-openssl",
      "title": "Create certificates with OpenSSL",
      "role": "content",
      "text": "1. Create a configuration file named `redis-cert.cnf` with the following content:\n\n    [code example]\n\n    Replace `redis-cluster.example.com` with your cluster's FQDN and replace the `[dn]` section with your own details. Check with your security team or certificate authority for help creating a valid configuration file for your environment.\n\n1. Create a private key:\n\n    [code example]\n\n    For enhanced security, use a 4096-bit key:\n\n    [code example]\n\n1. Create a certificate signing request (CSR):\n\n    [code example]\n\n1. [Verify the certificate signing request and submit it to your CA](#submit-csr-to-the-certificate-authority).\n\n1. [Create a certificate chain file](#create-a-certificate-chain-file).\n\n#### Submit CSR to the certificate authority\n\n1. Before submitting to your CA, verify the certificate signing request contains all required attributes:\n\n    [code example]\n\n    Check the output for the following:\n\n    - Subject contains the correct Common Name.\n\n    - Subject Alternative Names include all required DNS entries.\n\n    - Key Usage includes `Digital Signature, Key Encipherment`.\n\n    - Extended Key Usage includes `TLS Web Server Authentication, TLS Web Client Authentication`.\n\n1. Submit `redis-cert.csr` to your certificate authority for signing. The process varies by CA:\n\n    - For an internal CA, follow your organization's certificate request process.\n\n    - For a commercial CA, use their web portal or API.\n\n    - For testing or development purposes only, you can create a self-signed certificate:\n\n        [code example]\n\n        > [!WARNING]\n        > Do not use self-signed certificates in production.\n        >         \n\n#### Create a certificate chain file\n\nAfter receiving the signed certificate from your CA, create a certificate chain file by combining the certificates in the correct order:\n\n[code example]\n\nYou must order your certificates as follows:\n\n1. Leaf certificate, which is your domain certificate.\n\n1. Intermediate CA certificates.\n\n1. Root CA certificate, which is optional depending on your deployment."
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services",
      "title": "Create certificates with Windows Active Directory Certificate Services",
      "role": "content",
      "text": "To create certificates using Windows Active Directory Certificate Services:\n\n1. Complete the [prerequisites](#windows-ad-prereqs).\n\n1. [Create a modified Web Server template](#create-certificate-template).\n\n1. [Publish the template](#publish-the-template).\n\n1. [Request a certificate using certreq](#request-a-certificate-using-certreq).\n\n1. [Export the certificate and private key](#export-certificate-and-private-key).\n\n#### Prerequisites {#windows-ad-prereqs}\n\nBefore you can create certificates with Windows Active Directory Certificate Services, you need:\n\n- Access to Windows Active Directory Certificate Services.\n\n- Permissions to modify certificate templates.\n\n- Certificate Templates Console certtmpl.msc.\n\n#### Create certificate template\n\nThe default Web Server template in Windows AD CS only includes Server Authentication. You must create a modified template that includes both Server and Client Authentication.\n\n1. Open the Certificate Templates Console as an administrator:\n\n    [code example]\n\n1. Right-click the **Web Server** template, then select **Duplicate Template**.\n\n1. In the **General** tab:\n\n    1. Set **Template name** to `Redis Software Server`.\n\n    1. Set the **Validity period** to 1 year.\n\n1. In the **Extensions** tab:\n\n    1. Select **Application Policies**.\n\n    1. Click **Edit** and verify both of the following are present:\n\n        - Server Authentication (1.3.6.1.5.5.7.3.1)\n\n        - Client Authentication (1.3.6.1.5.5.7.3.2)\n\n    1. If Client Authentication is missing, click **Add**, select **Client Authentication**, and click **OK**.\n\n1. In the **Subject Name** tab, select **Supply in the request** to allow specifying Subject Alternative Names during the certificate request.\n\n1. In the **Extensions** tab:\n\n    1. Select **Key Usage**.\n\n    1. Click **Edit**.\n\n    1. Make sure **Digital signature** and **Key encipherment** are selected.\n\n1. In the **Security** tab:\n\n    1. Add appropriate users and groups.\n\n    1. Grant **Read** and **Enroll** permissions.\n\n1. Click **OK** to save the template.\n\n#### Publish the template\n\n1. Open the Certification Authority console:\n\n    [code example]\n\n1. Expand your CA.\n\n1. Right-click **Certificate Templates**, then select **New > Certificate Template to Issue**.\n\n1. Select `Redis Software Server` and click **OK**.\n\n#### Request a certificate using certreq\n\n1. Create a certificate request file `redis-cert.inf`:\n\n    [code example]\n\n    Replace `redis-cluster.example.com` with your cluster's FQDN.\n\n1. Generate the certificate request:\n\n    [code example]\n\n1. Submit the request to your CA:\n\n    [code example]\n\n1. Accept the issued certificate:\n\n    [code example]\n\n#### Export certificate and private key\n\n1. Open Certificate Manager:\n\n    [code example]\n\n1. Go to **Personal > Certificates**.\n\n1. Right-click your certificate, then select **All Tasks > Export**.\n\n1. Export the certificate with the private key:\n\n    1. Select **Yes, export the private key**.\n\n    1. Choose **Personal Information Exchange - PKCS #12 (.PFX)**.\n\n    1. Set a password.\n\n    1. Save as `redis-cert.pfx`.\n\n1. Convert the certificate and key to PEM format using OpenSSL:\n\n    1. Extract the certificate chain:\n\n        [code example]\n\n    1. Extract the private key:\n        [code example]"
    },
    {
      "id": "validate-certificates",
      "title": "Validate certificates",
      "role": "content",
      "text": "Before you upload certificates to Redis Software, validate that they meet all requirements:\n\n1. Validate extended key usage:\n\n    [code example]\n\n    Expected output:\n\n    [code example]\n\n    If Client Authentication is missing, the certificate will fail. You must reissue the certificate with both Server and Client Authentication.\n\n1. Validate key usage:\n\n    [code example]\n\n    Expected output:\n\n    [code example]\n\n1. Validate Subject Alternative Names:\n\n    [code example]\n\n    Expected output:\n\n    [code example]\n\n1. Validate certificate chain:\n\n    1. Count the certificates in the chain:\n\n        [code example]\n\n        Expected output: 2 or 3 if the root CA is included.\n\n    1. View all certificates in the chain:\n\n        [code example]\n\n    1. Verify the chain order. Each certificate's `Issuer` should match the `Subject` of the next certificate.\n\n1. Validate the signature algorithm:\n\n    [code example]\n\n    Expected output: `sha256WithRSAEncryption` or `sha512WithRSAEncryption`.\n    \n    > [!NOTE]\n    > Avoid `sha1WithRSAEncryption` because it is deprecated and might be blocked.\n    >     \n\n1. Validate the public key size:\n\n    [code example]\n\n    Expected output: `Public-Key: (2048 bit)` or higher.\n\n1. Verify the private key matches the certificate:\n\n    1. Get the certificate modulus:\n\n        [code example]\n\n    1. Get the key modulus:\n\n        [code example]\n\n    1. If the MD5 hashes do not match, you have the wrong private key file.\n\n1. Verify the certificate is currently valid and not expired:\n\n    [code example]"
    },
    {
      "id": "install-certificates",
      "title": "Install certificates",
      "role": "setup",
      "text": "After creating and validating your certificates, install them on the Redis Software cluster:\n\n1. Set restrictive file permissions for the private key:\n\n    [code example]\n\n1. Set readable file permissions for the certificate:\n\n    [code example]\n\n1. Replace the existing certificates with the new certificates using [`rladmin cluster certificate`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/certificate):\n\n    [code example]\n\n    Replace `<cert-name>` with the relevant certificate name:\n\n    | Value | Description |\n    |-------|-------------|\n    | `api` | REST API certificate |\n    | `cm` | Cluster Manager UI certificate |\n    | `metrics_exporter` | Metrics exporter certificate |\n    | `proxy` | Database endpoint proxy certificate |\n    | `syncer` | Synchronization process certificate |\n\n1. Verify the installed certificate:\n\n    [code example]"
    },
    {
      "id": "troubleshooting",
      "title": "Troubleshooting",
      "role": "errors",
      "text": "#### SSLV3_ALERT_UNSUPPORTED_CERTIFICATE error\n\nIf the certificate's extended key usage does not include TLS Web Client Authentication, the following error occurs:\n\n[code example]\n\nTo fix this error:\n\n1. Validate extended key usage:\n\n    [code example]\n\n1. If Client Authentication is missing, reissue the certificate:\n\n    - For OpenSSL, add the following line to the configuration file.\n\n        [code example]\n\n    - For Windows AD CS, modify the certificate template and add Client Authentication to **Application Policies**.\n\n#### CERTIFICATE_VERIFY_FAILED error\n\nIf a `CERTIFICATE_VERIFY_FAILED` error occurs, the certificate chain is incomplete or in the wrong order.\n\nTo fix this error:\n\n1. Verify the certificate chain order. Each certificate's `Issuer` should match the `Subject` of the next certificate.\n\n    [code example]\n\n1. Rebuild the certificate chain in the correct order:\n\n    [code example]\n\n#### Key values mismatch error\n\nIf a `key_values_mismatch` error occurs, the private key does not match the certificate.\n\nVerify the private key matches the certificate:\n\n1. Get the certificate modulus:\n\n    [code example]\n\n1. Get the key modulus:\n\n    [code example]\n\n1. If the MD5 hashes don't match, you have the wrong private key file. To fix this error, find the correct private key file.\n\n#### Missing Subject Alternative Names\n\nIf a certificate only has a Common Name, but no Subject Alternative Names, modern TLS implementations might reject it.\n\nTo fix this issue, reissue the certificate with proper Subject Alternative Names, including all required DNS entries."
    }
  ],
  "examples": [
    {
      "id": "step-1-generate-new-certificates-ex0",
      "language": " bash",
      "code": "% sudo -u redislabs /opt/redislabs/utils/generate_self_signed_certs.sh \\\n   -f \"<DomainName1 DomainName2>\" -d <Days> -t <Type>",
      "section_id": "step-1-generate-new-certificates"
    },
    {
      "id": "step-1-generate-new-certificates-ex1",
      "language": " bash",
      "code": "$ sudo -u redislabs /opt/redislabs/utils/generate_self_signed_certs.sh \\\n    -f \"mycluster.example.com\"`",
      "section_id": "step-1-generate-new-certificates"
    },
    {
      "id": "step-1-generate-new-certificates-ex2",
      "language": " bash",
      "code": "$ sudo -u redislabs /opt/redislabs/utils/generate_self_signed_certs.sh \\\n    -f \"mycluster.example.com anothercluster.example.com\" -d 730 -t cm",
      "section_id": "step-1-generate-new-certificates"
    },
    {
      "id": "step-1-generate-new-certificates-ex3",
      "language": " text",
      "code": "mycluster.example.com\n*.mycluster.example.com\nanothercluster.example.com \n*.anothercluster.example.com",
      "section_id": "step-1-generate-new-certificates"
    },
    {
      "id": "step-2-locate-the-new-certificate-files-ex0",
      "language": " bash",
      "code": "$ ls -la /tmp/*.pem",
      "section_id": "step-2-locate-the-new-certificate-files"
    },
    {
      "id": "step-3-set-permissions-ex0",
      "language": " bash",
      "code": "$ sudo chmod 644 /tmp/*.pem",
      "section_id": "step-3-set-permissions"
    },
    {
      "id": "replace-self-signed-ex0",
      "language": " console",
      "code": "$ rladmin cluster certificate set <CertName> certificate_file \\\n   <CertFilename>.pem key_file <KeyFilename>.pem",
      "section_id": "replace-self-signed"
    },
    {
      "id": "certificate-requirements-ex0",
      "language": "sh",
      "code": "-----BEGIN CERTIFICATE-----\n    <Leaf/Domain Certificate>\n    -----END CERTIFICATE-----\n    -----BEGIN CERTIFICATE-----\n    <Intermediate CA Certificate>\n    -----END CERTIFICATE-----\n    -----BEGIN CERTIFICATE-----\n    <Root CA Certificate>\n    -----END CERTIFICATE-----",
      "section_id": "certificate-requirements"
    },
    {
      "id": "certificate-requirements-ex1",
      "language": "ini",
      "code": "dns=<cluster-fqdn>\n    dns=*.<cluster-fqdn>\n    dns=internal.<cluster-fqdn>\n    dns=*.internal.<cluster-fqdn>",
      "section_id": "certificate-requirements"
    },
    {
      "id": "certificate-requirements-ex2",
      "language": "ini",
      "code": "dns=redis.example.com\n    dns=*.redis.example.com\n    dns=internal.redis.example.com\n    dns=*.internal.redis.example.com",
      "section_id": "certificate-requirements"
    },
    {
      "id": "create-certificates-with-openssl-ex0",
      "language": "ini",
      "code": "[req]\n    default_bits = 2048\n    prompt = no\n    default_md = sha256\n    distinguished_name = dn\n    req_extensions = v3_req\n\n    [dn]\n    C = US\n    ST = California\n    L = Los Angeles\n    O = Your Organization\n    CN = redis-cluster.example.com\n\n    [v3_req]\n    keyUsage = critical, digitalSignature, keyEncipherment\n    extendedKeyUsage = serverAuth, clientAuth\n    subjectAltName = @alt_names\n\n    [alt_names]\n    DNS.1 = redis-cluster.example.com\n    DNS.2 = *.redis-cluster.example.com\n    DNS.3 = internal.redis-cluster.example.com\n    DNS.4 = *.internal.redis-cluster.example.com",
      "section_id": "create-certificates-with-openssl"
    },
    {
      "id": "create-certificates-with-openssl-ex1",
      "language": "sh",
      "code": "openssl genrsa -out redis-key.pem 2048",
      "section_id": "create-certificates-with-openssl"
    },
    {
      "id": "create-certificates-with-openssl-ex2",
      "language": "sh",
      "code": "openssl genrsa -out redis-key.pem 4096",
      "section_id": "create-certificates-with-openssl"
    },
    {
      "id": "create-certificates-with-openssl-ex3",
      "language": "sh",
      "code": "openssl req -new \\\n        -key redis-key.pem \\\n        -out redis-cert.csr \\\n        -config redis-cert.cnf",
      "section_id": "create-certificates-with-openssl"
    },
    {
      "id": "create-certificates-with-openssl-ex4",
      "language": "sh",
      "code": "openssl req -text -noout -verify -in redis-cert.csr",
      "section_id": "create-certificates-with-openssl"
    },
    {
      "id": "create-certificates-with-openssl-ex5",
      "language": "sh",
      "code": "openssl x509 -req \\\n          -in redis-cert.csr \\\n          -signkey redis-key.pem \\\n          -out redis-cert.pem \\\n          -days 365 \\\n          -extensions v3_req \\\n          -extfile redis-cert.cnf",
      "section_id": "create-certificates-with-openssl"
    },
    {
      "id": "create-certificates-with-openssl-ex6",
      "language": "sh",
      "code": "cat redis-cert.pem intermediate-ca.pem root-ca.pem > redis-cert-chain.pem",
      "section_id": "create-certificates-with-openssl"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex0",
      "language": "sh",
      "code": "certtmpl.msc",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex1",
      "language": "sh",
      "code": "certsrv.msc",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex2",
      "language": "ini",
      "code": "[NewRequest]\n    Subject = \"CN=redis-cluster.example.com,O=Your Organization,L=City,ST=State,C=US\"\n    KeyLength = 2048\n    KeySpec = 1\n    Exportable = TRUE\n    MachineKeySet = TRUE\n    ProviderName = \"Microsoft RSA SChannel Cryptographic Provider\"\n    RequestType = PKCS10\n\n    [Extensions]\n    2.5.29.17 = \"{text}\"\n    _continue_ = \"dns=redis-cluster.example.com&\"\n    _continue_ = \"dns=*.redis-cluster.example.com&\"\n    _continue_ = \"dns=internal.redis-cluster.example.com&\"\n    _continue_ = \"dns=*.internal.redis-cluster.example.com\"",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex3",
      "language": "sh",
      "code": "certreq -new redis-cert.inf redis-cert.req",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex4",
      "language": "sh",
      "code": "certreq -submit -config \"CA-SERVER\\CA-Name\" redis-cert.req redis-cert.cer",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex5",
      "language": "sh",
      "code": "certreq -accept redis-cert.cer",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex6",
      "language": "sh",
      "code": "certlm.msc",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex7",
      "language": "sh",
      "code": "openssl pkcs12 -in redis-cert.pfx -nokeys -out redis-cert.pem",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "create-certificates-with-windows-active-directory-certificate-services-ex8",
      "language": "sh",
      "code": "openssl pkcs12 -in redis-cert.pfx -nocerts -out redis-key.pem -nodes",
      "section_id": "create-certificates-with-windows-active-directory-certificate-services"
    },
    {
      "id": "validate-certificates-ex0",
      "language": "sh",
      "code": "openssl x509 -in redis-cert-chain.pem -text -noout | grep -A 3 \"Extended Key Usage\"",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex1",
      "language": "sh",
      "code": "X509v3 Extended Key Usage:\n        TLS Web Server Authentication, TLS Web Client Authentication",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex2",
      "language": "bash",
      "code": "openssl x509 -in redis-cert-chain.pem -text -noout | grep -A 2 \"Key Usage\"",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex3",
      "language": "text",
      "code": "X509v3 Key Usage: critical\n        Digital Signature, Key Encipherment",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex4",
      "language": "sh",
      "code": "openssl x509 -in redis-cert-chain.pem -text -noout | grep -A 10 \"Subject Alternative Name\"",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex5",
      "language": "sh",
      "code": "X509v3 Subject Alternative Name:\n        DNS:redis-cluster.example.com\n        DNS:*.redis-cluster.example.com\n        DNS:internal.redis-cluster.example.com\n        DNS:*.internal.redis-cluster.example.com",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex6",
      "language": "sh",
      "code": "grep -c \"BEGIN CERTIFICATE\" redis-cert-chain.pem",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex7",
      "language": "bash",
      "code": "openssl crl2pkcs7 -nocrl -certfile redis-cert-chain.pem | \\\n            openssl pkcs7 -print_certs -text -noout | \\\n            grep -E \"Subject:|Issuer:\"",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex8",
      "language": "bash",
      "code": "openssl x509 -in redis-cert-chain.pem -text -noout | grep \"Signature Algorithm\"",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex9",
      "language": "bash",
      "code": "openssl x509 -in redis-cert-chain.pem -text -noout | grep \"Public-Key\"",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex10",
      "language": "sh",
      "code": "openssl x509 -noout -modulus -in redis-cert-chain.pem | openssl md5",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex11",
      "language": "sh",
      "code": "openssl rsa -noout -modulus -in redis-key.pem | openssl md5",
      "section_id": "validate-certificates"
    },
    {
      "id": "validate-certificates-ex12",
      "language": "bash",
      "code": "openssl x509 -in redis-cert-chain.pem -noout -dates",
      "section_id": "validate-certificates"
    },
    {
      "id": "install-certificates-ex0",
      "language": "bash",
      "code": "$ chmod 600 redis-key.pem\n    $ chown redislabs:redislabs redis-key.pem",
      "section_id": "install-certificates"
    },
    {
      "id": "install-certificates-ex1",
      "language": "bash",
      "code": "$ chmod 644 redis-cert-chain.pem\n    $ chown redislabs:redislabs redis-cert-chain.pem",
      "section_id": "install-certificates"
    },
    {
      "id": "install-certificates-ex2",
      "language": "bash",
      "code": "rladmin cluster certificate set <cert-name> \\\n        certificate_file /path/to/redis-cert-chain.pem \\\n        key_file /path/to/redis-key.pem",
      "section_id": "install-certificates"
    },
    {
      "id": "install-certificates-ex3",
      "language": "sh",
      "code": "openssl x509 -in /etc/opt/redislabs/<cert-name>_cert.pem -noout -subject -issuer -dates",
      "section_id": "install-certificates"
    },
    {
      "id": "troubleshooting-ex0",
      "language": "sh",
      "code": "[SSL: SSLV3_ALERT_UNSUPPORTED_CERTIFICATE] ssl/tls alert unsupported certificate",
      "section_id": "troubleshooting"
    },
    {
      "id": "troubleshooting-ex1",
      "language": "bash",
      "code": "openssl x509 -in redis-cert-chain.pem -text -noout | grep -A 3 \"Extended Key Usage\"",
      "section_id": "troubleshooting"
    },
    {
      "id": "troubleshooting-ex2",
      "language": "ini",
      "code": "extendedKeyUsage = serverAuth, clientAuth",
      "section_id": "troubleshooting"
    },
    {
      "id": "troubleshooting-ex3",
      "language": "sh",
      "code": "openssl crl2pkcs7 -nocrl -certfile redis-cert-chain.pem | \\\n        openssl pkcs7 -print_certs -text -noout | \\\n        grep -E \"Subject:|Issuer:\"",
      "section_id": "troubleshooting"
    },
    {
      "id": "troubleshooting-ex4",
      "language": "sh",
      "code": "-----BEGIN CERTIFICATE-----\n    <Leaf/Domain Certificate>\n    -----END CERTIFICATE-----\n    -----BEGIN CERTIFICATE-----\n    <Intermediate CA Certificate>\n    -----END CERTIFICATE-----\n    -----BEGIN CERTIFICATE-----\n    <Root CA Certificate>\n    -----END CERTIFICATE-----",
      "section_id": "troubleshooting"
    },
    {
      "id": "troubleshooting-ex5",
      "language": "sh",
      "code": "openssl x509 -noout -modulus -in redis-cert-chain.pem | openssl md5",
      "section_id": "troubleshooting"
    },
    {
      "id": "troubleshooting-ex6",
      "language": "sh",
      "code": "openssl rsa -noout -modulus -in redis-key.pem | openssl md5",
      "section_id": "troubleshooting"
    }
  ]
}