Enable TLS for Redis

The fix/etc/redis/redis.conf

port 0
tls-port 6379
tls-cert-file /etc/redis/tls/redis.crt
tls-key-file /etc/redis/tls/redis.key
tls-ca-cert-file /etc/redis/tls/ca.crt
tls-auth-clients yes

port 0 disables the plaintext listener entirely. Restart to apply.

Why it matters

Redis’s own documentation is explicit that AUTH, “like every other Redis command, is sent unencrypted” and therefore “does not protect against an attacker who has enough access to the network to perform eavesdropping.”

So without TLS, your carefully generated 48-byte secret is transmitted in cleartext on every single connection, alongside every key and value you read or write. Anyone positioned on the path — another tenant, a compromised switch, a misconfigured mirror port, a cloud provider’s internal network — sees all of it.

TLS is what makes the authentication you configured actually mean something over a network. On a loopback-only instance it buys you little; the moment traffic crosses a wire, it’s the difference between a secret and a broadcast.

port 0 is the line that matters

Setting tls-port adds a TLS listener. It does not remove the plaintext one. An instance with both is not protected: an attacker (or a misconfigured client) simply connects to the plaintext port, and you get none of the benefit while believing you have all of it.

port 0 is what closes it. If you need a transition period, run both briefly, then set port 0 once every client is migrated — and verify with ss rather than assuming.

tls-auth-clients cuts both ways

tls-auth-clients yes requires clients to present their own certificate — mutual TLS. It’s a genuine second factor for the connection, and it’s the default.

It also means every client needs a certificate issued by your CA, which is real operational work. tls-auth-clients no gives you encryption without client certificates; that is still a large improvement over plaintext, and it is a reasonable stop if issuing client certs isn’t realistic yet. Just choose it deliberately rather than discovering it when clients fail to connect.

Check your build supports it

TLS is compiled in, not universal. Distribution packages for Redis and Valkey generally include it, but a binary you built yourself may not:

redis-server --tls-port 0 2>&1 | head -1

If TLS is unsupported you’ll get an error about an unknown option rather than a working server.

Verify it worked

Confirm the plaintext port is gone and only TLS is listening:

sudo ss -lntp | grep -E 'redis|valkey'

Expect one line on 6379 — and make sure a plaintext client is refused:

redis-cli -p 6379 PING

That should fail. The TLS client should succeed:

redis-cli --tls \
  --cert /etc/redis/tls/client.crt \
  --key /etc/redis/tls/client.key \
  --cacert /etc/redis/tls/ca.crt PING

Expect PONG. Then confirm what the server thinks:

redis-cli --tls ... CONFIG GET tls-auth-clients

To see the negotiated connection independently of redis-cli:

openssl s_client -connect 127.0.0.1:6379 -CAfile /etc/redis/tls/ca.crt </dev/null 2>&1 | grep -E 'Protocol|Cipher|Verify return'

Before you apply this

Every client breaks at once when you set port 0. Redis clients do not negotiate or upgrade — a plaintext client hitting a TLS port gets a protocol error, not a fallback.

Sequence that avoids the outage:

1. Add tls-port while leaving port in place. Both listeners run.
2. Migrate clients to TLS one at a time and confirm each with CLIENT LIST.
3. Set port 0 only when nothing is left on the plaintext port.

Two things that will catch you regardless:

• Certificate expiry takes the whole instance down, not gracefully. Whatever issues these certs needs renewal automation and monitoring before you rely on it.
• Replicas and the cluster bus need their own settings. tls-replication yes and tls-cluster yes are separate; enabling client TLS alone leaves replication traffic in the clear, which is exactly the data you were trying to protect.

Related

• Require authentication with ACL users — the credential TLS protects.
• Bind Redis to a private interface — if nothing crosses a wire, this matters less.