{
  "schema_version": 2,
  "id": "operate/rs/security/encryption/pem-encryption",
  "title": "Encrypt private keys",
  "url": "https://redis.io/docs/latest/operate/rs/security/encryption/pem-encryption/",
  "summary": "Enable PEM encryption to encrypt all private keys on disk.",
  "tags": [
    "docs",
    "operate",
    "rs"
  ],
  "last_updated": "2026-09-24T09:16:28+01:00",
  "page_type": "content",
  "content_hash": "84b155658d667f63d334a04d79ec6a34b350c40c772d513b499875eacffdc708",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Enable PEM encryption to automatically encrypt all private keys on disk. Public keys (`.cert` files) are not encrypted.\n\nWhen certificates are rotated, the encrypted private keys are also rotated."
    },
    {
      "id": "enable-pem-encryption",
      "title": "Enable PEM encryption",
      "role": "content",
      "text": "To enable PEM encryption and encrypt private keys on the disk, use [`rladmin`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin) or the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api).\n\n\n- [`rladmin cluster config`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/config):\n\n    [code example]\n\n- [Update cluster settings](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster#put-cluster) REST API request:\n\n    [code example]"
    },
    {
      "id": "deactivate-pem-encryption",
      "title": "Deactivate PEM encryption",
      "role": "content",
      "text": "To deactivate PEM encryption and decrypt private keys on the disk, use [`rladmin`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin) or the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api).\n\n- [`rladmin cluster config`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/config):\n\n    [code example]\n\n- [Update cluster settings](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster#put-cluster) REST API request:\n\n    [code example]"
    }
  ],
  "examples": [
    {
      "id": "enable-pem-encryption-ex0",
      "language": "sh",
      "code": "rladmin cluster config encrypt_pkeys enabled",
      "section_id": "enable-pem-encryption"
    },
    {
      "id": "enable-pem-encryption-ex1",
      "language": "sh",
      "code": "PUT /v1/cluster\n    { \"encrypt_pkeys\": true }",
      "section_id": "enable-pem-encryption"
    },
    {
      "id": "deactivate-pem-encryption-ex0",
      "language": "sh",
      "code": "rladmin cluster config encrypt_pkeys disabled",
      "section_id": "deactivate-pem-encryption"
    },
    {
      "id": "deactivate-pem-encryption-ex1",
      "language": "sh",
      "code": "PUT /v1/cluster\n    { \"encrypt_pkeys\": false }",
      "section_id": "deactivate-pem-encryption"
    }
  ]
}