{
  "schema_version": 2,
  "id": "operate/rs/security/encryption/internode-encryption",
  "title": "Internode encryption",
  "url": "https://redis.io/docs/latest/operate/rs/security/encryption/internode-encryption/",
  "summary": "Describes internode encryption which improves the security of data in transit.",
  "tags": [
    "docs",
    "operate",
    "rs"
  ],
  "last_updated": "2026-10-02T16:06:07+01:00",
  "page_type": "content",
  "content_hash": "afb5413832dd91699a5ab79300ce05426f0603fcd3b00316dec5a8ab0dfc7ada",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "As of v6.2.4, Redis Software supports _internode encryption_, which encrypts internal communication between nodes. This improves the security of data as it travels within a cluster.\n\nInternode encryption is enabled for the _control plane_, which manages the cluster and its databases.\n\nInternode encryption is supported for the _data plane_, which encrypts communication used to replicate shards between nodes and proxy communication with shards located on different nodes.\n\nThe following diagram shows how this works.\n\n![A diagram showing the interaction between data internode encryption, control plane encryption, and various elements of a cluster.](https://redis.io/docs/latest/images/rs/internode-encryption.png)\n\nData internode encryption is disabled by default for individual databases in order to optimize for performance.  Encryption adds latency and overhead; the impact is measurable and varies according to the database, its field types, and the details of the underlying use case. \n\nYou can enable data internode encryption for a database by changing the database configuration settings.  This lets you choose when to favor performance and when to encrypt data."
    },
    {
      "id": "prerequisites",
      "title": "Prerequisites",
      "role": "content",
      "text": "Internode encryption requires certain prerequisites.  \n\nYou need to:\n\n- Upgrade all nodes in the cluster to v6.2.4 or later.\n\n- Open port 3342 for the TLS channel used for encrypted communication."
    },
    {
      "id": "enable-data-internode-encryption",
      "title": "Enable data internode encryption",
      "role": "content",
      "text": "To enable internode encryption for a database (also called _data internode encryption_), you need to enable the appropriate setting for each database you wish to encrypt.  To do so, you can:\n\n- Use the Cluster Manager UI to enable the **Internode Encryption** setting from the database **Security** screen.\n\n-  Use the `rladmin` command-line utility to set the [data_internode_encryption](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/tune#tune-db) setting for the database:\n\n    [code example] \n\n- Use the Redis Software REST API to set the `data_internode_encryption` setting for the database.\n\n    [code example]\n\nWhen you change the data internode encryption setting for a database, all active remote client connections are disconnected.  This restarts the internal (DMC) proxy and disconnects all client connections."
    },
    {
      "id": "change-cluster-policy",
      "title": "Change cluster policy",
      "role": "content",
      "text": "To enable internode encryption for new databases by default, use one of the following methods:\n\n- Cluster Manager UI\n\n    1. On the **Databases** screen, select ![Toggle actions button](https://redis.io/docs/latest/images/rs/buttons/button-toggle-actions-vertical.png#no-click) to open a list of additional actions.\n\n    1. Select **Database defaults**.\n\n    1. Go to **Internode Encryption** and click **Change**.\n\n    1. Select **Enabled** to enable internode encryption for new databases by default.\n\n    1. Click **Change**.\n\n    1. Select **Save**.\n\n- [rladmin tune cluster](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster): \n    \n    [code example]\n\n- [Update cluster policy](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster/policy#put-cluster-policy) REST API request:\n\n    [code example]"
    },
    {
      "id": "self-signed-certificates",
      "title": "Self-signed certificates",
      "role": "content",
      "text": "By default, Redis Software uses self-signed certificates for internode encryption. These certificates are automatically generated, managed, and rotated by the system."
    },
    {
      "id": "encryption-ciphers-and-settings",
      "title": "Encryption ciphers and settings",
      "role": "content",
      "text": "To encrypt internode communications, Redis Software uses TLS 1.2 and the following cipher suites:\n\n- ECDHE-RSA-AES256-GCM-SHA384\n- ECDHE-RSA-AES128-GCM-SHA256\n\nAs of Redis Software v7.4, internode encryption also supports TLS 1.3 with the following cipher suites:\n\n- TLS_AES_128_GCM_SHA256\n- TLS_AES_256_GCM_SHA384\n\nThe TLS layer determines which TLS version to use.\n\nNo configurable settings are exposed; internode encryption is used internally within a cluster and not exposed to any outside service."
    },
    {
      "id": "certificate-authority-and-rotation",
      "title": "Certificate authority and rotation",
      "role": "content",
      "text": "Starting with v6.2.4, internode communication is managed, in part, by two certificates: one for the control plane and one for the data plane.  These certificates are signed by a private certificate authority (CA).  The CA is not exposed outside of the cluster, so it cannot be accessed by external processes or services.  In addition, each cluster generates a unique CA that is not used anywhere else.\n\nThe private CA is generated when a cluster is created or upgraded to 6.2.4.  \n\nWhen nodes join the cluster, the cluster CA is used to generate certificates for the new node, one for each plane.  Certificates signed by the private CA are not shared between clusters and they're not exposed outside the cluster.\n\nAll certificates signed by the internal CA expire after ninety (90) days and automatically rotate every thirty (30) days.  Alerts also monitor certificate expiration and trigger when certificate expiration falls below 45 days.  If you receive such an alert, contact support.\n\nYou can use the Redis Software REST API to rotate certificates manually:\n\n[code example]"
    },
    {
      "id": "customer-provided-certificates",
      "title": "Customer-provided certificates",
      "role": "content",
      "text": "Instead of using Redis Software's self-signed certificates for internode encryption, you can provide certificates generated by your Certificate Authority (CA)."
    },
    {
      "id": "certificate-requirements",
      "title": "Certificate requirements",
      "role": "content",
      "text": "Customer-provided internode encryption certificates must meet the following requirements:\n\n- Certificates must be in PEM format.\n\n- Certificates must contain the certificate chain and the leaf certificate.\n\n- Certificates must use an RSA key. Using other key types, such as ECDSA or EdDSA, might prevent internode encryption from working.\n\n- Certificates must be created with the TLS Web Client Authentication attribute enabled."
    },
    {
      "id": "upload-customer-provided-certificates",
      "title": "Upload customer-provided certificates",
      "role": "content",
      "text": "You can upload either:\n\n- One certificate for both data plane internode encryption (DPINE) and control plane internode encryption (CPINE).\n\n- Two separate certificates: one for DPINE and one for CPINE.\n\nTo upload internode encryption certificates, use one of the following methods:\n\n**Cluster Manager UI:**\n\n1. In the Cluster Manager UI, go to **Cluster > Security > Certificates**.\n\n1. Expand the **Internode encryption certificates** section.\n\n1. Click **Replace certificates**.\n\n1. In the **Internode encryption certificates** panel, select one of the following options:\n\n    - Use the same certificate for data and control plane internode encryption\n\n    - Use separate certificates for data and control plane internode encryption\n\n1. For each certificate and key, click **Upload** and use the file browser to select the relevant PEM file.\n\n1. Click **Save & Rotate**.\n\n**rladmin:**\n\nTo use the same certificate for data and control plane internode encryption, run the following [`rladmin cluster certificate`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/certificate#cluster-certificate-set-internal) command:\n\n[code example]\n\nTo use separate certificates for data and control plane internode encryption, run the following [`rladmin cluster certificate`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/certificate#cluster-certificate-set-internal) command:\n\n[code example]\n\n**REST API:**\n\nTo use the same certificate for data and control plane internode encryption, send a [`PUT /v1/cluster/certificates`](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster/certificates#put-cluster-certificates) request:\n\n[code example]\n\nTo use separate certificates for data and control plane internode encryption, send a [`PUT /v1/cluster/certificates`](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster/certificates#put-cluster-certificates) request:\n\n[code example]"
    },
    {
      "id": "certificate-expiration-and-rotation",
      "title": "Certificate expiration and rotation",
      "role": "content",
      "text": "Customer-provided internode encryption certificates are not rotated automatically. To prevent possible issues with cluster and database unavailability caused by expired internode encryption certificates:\n\n- You should monitor the certificates' expiration dates and [renew them](https://redis.io/docs/latest/operate/rs/security/certificates/updating-certificates#how-to-update-certificates) before they expire.\n\n- In case you do not renew the customer-managed certificates before they expire, Redis Software automatically replaces them with self-signed certificates 5 days before expiration. You can upload new customer-provided certificates to replace these certificates anytime."
    },
    {
      "id": "performance-recommendations",
      "title": "Performance recommendations",
      "role": "performance",
      "text": "For optimal performance with customer-provided certificates, follow the same recommendations as for self-signed certificates detailed in the [Encryption ciphers and settings](#encryption-ciphers-and-settings) section."
    }
  ],
  "examples": [
    {
      "id": "enable-data-internode-encryption-ex0",
      "language": " shell",
      "code": "rladmin tune db <database_id> data_internode_encryption enabled",
      "section_id": "enable-data-internode-encryption"
    },
    {
      "id": "enable-data-internode-encryption-ex1",
      "language": " rest",
      "code": "put /v1/bdbs/${database_id}\n    { \"data_internode_encryption\" : true }",
      "section_id": "enable-data-internode-encryption"
    },
    {
      "id": "change-cluster-policy-ex0",
      "language": "sh",
      "code": "rladmin tune cluster data_internode_encryption enabled",
      "section_id": "change-cluster-policy"
    },
    {
      "id": "change-cluster-policy-ex1",
      "language": "sh",
      "code": "PUT /v1/cluster/policy \n    { \"data_internode_encryption\": true }",
      "section_id": "change-cluster-policy"
    },
    {
      "id": "certificate-authority-and-rotation-ex0",
      "language": " rest",
      "code": "POST /v1/cluster/certificates/rotate",
      "section_id": "certificate-authority-and-rotation"
    },
    {
      "id": "upload-customer-provided-certificates-ex0",
      "language": "sh",
      "code": "rladmin cluster certificate set internal dpine_certificate_file <path-to-shared-cert> dpine_key_file <path-to-shared-key> cpine_certificate_file <path-to-shared-cert> cpine_key_file <path-to-shared-key>",
      "section_id": "upload-customer-provided-certificates"
    },
    {
      "id": "upload-customer-provided-certificates-ex1",
      "language": "sh",
      "code": "rladmin cluster certificate set internal dpine_certificate_file <path-to-dpine-cert> dpine_key_file <path-to-dpine-key> cpine_certificate_file <path-to-cpine-cert> cpine_key_file <path-to-cpine-key>",
      "section_id": "upload-customer-provided-certificates"
    },
    {
      "id": "upload-customer-provided-certificates-ex2",
      "language": "sh",
      "code": "PUT https://<host>:<port>/v1/cluster/certificates\n{\n  \"certificates\": [\n    {\n      \"name\": \"ccs_internode_encryption\",\n      \"key\": \"<shared-private-key>\",\n      \"certificate\": \"<shared-certificate-chain>\"\n    },\n    {\n      \"name\": \"data_internode_encryption\",\n      \"key\": \"<shared-private-key>\",\n      \"certificate\": \"<shared-certificate-chain>\"\n    }\n  ]\n}",
      "section_id": "upload-customer-provided-certificates"
    },
    {
      "id": "upload-customer-provided-certificates-ex3",
      "language": "sh",
      "code": "PUT https://<host>:<port>/v1/cluster/certificates\n{\n  \"certificates\": [\n    {\n      \"name\": \"ccs_internode_encryption\",\n      \"key\": \"<cpine-private-key>\",\n      \"certificate\": \"<cpine-certificate-chain>\"\n    },\n    {\n      \"name\": \"data_internode_encryption\",\n      \"key\": \"<dpine-private-key>\",\n      \"certificate\": \"<dpine-certificate-chain>\"\n    }\n  ]\n}",
      "section_id": "upload-customer-provided-certificates"
    }
  ]
}