{
  "schema_version": 2,
  "id": "operate/rs/security/encryption/tls/tls-protocols",
  "title": "Configure TLS protocol",
  "url": "https://redis.io/docs/latest/operate/rs/security/encryption/tls/tls-protocols/",
  "summary": "",
  "tags": [
    "docs",
    "operate",
    "rs"
  ],
  "last_updated": "2026-10-01T15:48:36+01:00",
  "page_type": "content",
  "content_hash": "7faa4b2824d18e19283cda0707215f0c42953b3e548cf0fbfcc0c390ec340105",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "You can change TLS protocols to improve the security of your Redis Software cluster and databases. The default settings are in line with industry best practices, but you can customize them to match the security policy of your organization."
    },
    {
      "id": "configure-tls-protocol",
      "title": "Configure TLS protocol",
      "role": "configuration",
      "text": "The communications for which you can modify TLS protocols are:\n\n- Control plane - The TLS configuration for cluster administration.\n- Data plane - The TLS configuration for the communication between applications and databases.\n- Discovery service (Sentinel) - The TLS configuration for the [discovery service](https://redis.io/docs/latest/operate/rs/databases/durability-ha/discovery-service).\n\nYou can configure TLS protocols with the [Cluster Manager UI](#edit-tls-ui), [`rladmin`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/config), or the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster#put-cluster).\n\n> [!WARNING]\n> - After you set the minimum TLS version, Redis Software does not accept communications with TLS versions older than the specified version.\n>\n> - If you set TLS 1.3 as the minimum TLS version, clients must support TLS 1.3 to connect to Redis Software.\n\nTLS support depends on the operating system. You cannot enable support for protocols or versions that aren't supported by the operating system running Redis Software.  In addition, updates to the operating system or to Redis Software can impact protocol and version support.  \n\nIf you have trouble enabling specific versions of TLS, verify that they're supported by your operating system and that they're configured correctly.\n\n> [!NOTE]\n> TLSv1.2 is generally recommended as the minimum TLS version for encrypted communications. Check with your security team to confirm which TLS protocols meet your organization's policies."
    },
    {
      "id": "edit-tls-ui",
      "title": "Edit TLS settings in the UI",
      "role": "content",
      "text": "To configure minimum TLS versions using the Cluster Manager UI:\n\n1. Go to **Cluster > Security**, then select the **TLS** tab.\n\n1. Click **Edit**.\n\n1. Select the minimum TLS version for cluster connections, database connections, and the discovery service:\n\n    ![Cluster > Security > TLS settings in edit mode in the Cluster Manager UI.](https://redis.io/docs/latest/images/rs/screenshots/cluster/security-tls-protocols-edit.png)\n  \n1. Select the TLS mode for the discovery service:\n\n    - **Allowed** - Allows both TLS and non-TLS connections\n    - **Required** - Allows only TLS connections\n    - **Disabled** - Allows only non-TLS connections\n\n1. Click **Save**."
    },
    {
      "id": "control-plane-tls",
      "title": "Control plane TLS",
      "role": "content",
      "text": "To set the minimum TLS protocol for the control plane using `rladmin`:\n\n- Default minimum TLS protocol: TLSv1.2\n- Syntax: `rladmin cluster config min_control_TLS_version <TLS_Version>`\n- TLS versions available:\n  - For TLSv1.2 - 1.2\n  - For TLSv1.3 - 1.3\n\nFor example:\n\n[code example]"
    },
    {
      "id": "data-plane-tls",
      "title": "Data plane TLS",
      "role": "content",
      "text": "To set the minimum TLS protocol for the data path using `rladmin`:\n\n- Default minimum TLS protocol: TLSv1.2\n- Syntax: `rladmin cluster config min_data_TLS_version <TLS_Version>`\n- TLS versions available:\n  - For TLSv1.2 - 1.2\n  - For TLSv1.3 - 1.3\n\nFor example:\n\n[code example]"
    },
    {
      "id": "discovery-service-tls",
      "title": "Discovery service TLS",
      "role": "content",
      "text": "To enable TLS for the discovery service using `rladmin`:\n\n- Default: Allows both TLS and non-TLS connections\n- Syntax: `rladmin cluster config sentinel_tls_mode <ssl_policy>`\n- `ssl_policy` values available:\n  - `allowed` - Allows both TLS and non-TLS connections\n  - `required` - Allows only TLS connections\n  - `disabled` - Allows only non-TLS connections\n\nTo set the minimum TLS protocol for the discovery service using `rladmin`:\n\n- Default minimum TLS protocol: TLSv1.2\n- Syntax: `rladmin cluster config min_sentinel_TLS_version <TLS_Version>`\n- TLS versions available:\n  - For TLSv1.2 - 1.2\n  - For TLSv1.3 - 1.3\n\nTo enforce a minimum TLS version for the discovery service, run the following commands:\n\n1. Allow only TLS connections:\n\n    [code example]\n\n1. Set the minimal TLS version:\n\n    [code example]\n\n1. Restart the discovery service on all cluster nodes to apply your changes:\n\n    [code example]"
    }
  ],
  "examples": [
    {
      "id": "control-plane-tls-ex0",
      "language": "sh",
      "code": "rladmin cluster config min_control_TLS_version 1.2",
      "section_id": "control-plane-tls"
    },
    {
      "id": "data-plane-tls-ex0",
      "language": "sh",
      "code": "rladmin cluster config min_data_TLS_version 1.2",
      "section_id": "data-plane-tls"
    },
    {
      "id": "discovery-service-tls-ex0",
      "language": "sh",
      "code": "rladmin cluster config sentinel_tls_mode required",
      "section_id": "discovery-service-tls"
    },
    {
      "id": "discovery-service-tls-ex1",
      "language": "sh",
      "code": "rladmin cluster config min_sentinel_TLS_version 1.2",
      "section_id": "discovery-service-tls"
    },
    {
      "id": "discovery-service-tls-ex2",
      "language": "sh",
      "code": "supervisorctl restart sentinel_service",
      "section_id": "discovery-service-tls"
    }
  ]
}