Both ports open during a migration
Unmigrated clients keep using plaintext, silently
- tls-port
- 6379
- allow-plaintext
- yes
Redis TLS Config Generator
Generate the TLS block for redis.conf. The trap is that TLS is a separate port: setting tls-port does not close the plaintext one, so an instance can look migrated while still accepting unencrypted connections on 6379.
tls.conf
updates as you typeExamples
Worked setups you can load into the form above. Each one is a decision the generator makes differently, and the reason it makes it.
TLS without client certificates
Encrypted, but the client is still not identified
- tls-port
- 6379
- client-certificates
- no
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Setting tls-port and thinking the migration is done
The plaintext port stays open until port is set to 0, and a client using it looks exactly like one that is not.
Instead:Set port 0 once every client has moved.
Leaving tls-replication off
The replication link stays unencrypted, so the whole dataset crosses the network in the clear on every full resync.
Instead:Set tls-replication yes and tls-cluster yes.
Pointing tls-ca-cert-file at a public CA bundle
That would trust any certificate signed by any public CA, which is every certificate on the internet.
Instead:Point it at the CA that signed your client certificates.
Not tracking certificate expiry
Expiry is a cluster-wide authentication outage that arrives without warning.
Instead:Automate renewal and alert well before the date.
Three connections, and TLS is configured separately for each
A Redis node makes more than one kind of connection, and enabling TLS for clients does not enable it for the others.
port 0 is what closes the plaintext listener
Setting tls-port adds a TLS listener. It does not remove the plaintext one. Until port is set to 0, the instance still accepts unencrypted connections, and nothing in a successful client connection reveals which listener it used.
Replication is a separate connection
A replica connecting to its primary does not use TLS just because client TLS is on. tls-replication yes is what encrypts it, and without it the entire dataset crosses the network in the clear on every full resync.
The cluster bus is another one again
Nodes gossip over the bus port, and tls-cluster controls that independently. Leaving it off means cluster state and the node ids travel unencrypted while client traffic is protected.
Encryption is not authentication
TLS without client certificates gives confidentiality only: anyone who can reach the port still connects and authenticates with a password. tls-auth-clients yes requires a certificate signed by your CA, and that certificate can then serve as the identity an ACL is written against.
Expiry is an outage with no warning
Certificates expire on a date that is rarely diarised, and the failure is total authentication loss across the cluster. Redis reloads certificates on CONFIG SET, so renewal does not require a restart, which makes automating it straightforward.
Related redis tools
Redis Config File Generator A redis.conf with the reasons in it Redis Maxmemory Config Generator The limit, and the headroom it needs Redis Persistence Config Generator How much you can afford to lose Redis Sentinel Config Generator Failover that can actually be authorised Redis Cluster Config Generator Three primaries, and the bus port open Redis Client Config Generator Timeouts on both sides, and a sane pool
All 53 redis tools