{
  "schema_version": 2,
  "id": "operate/kubernetes/security/certificates",
  "title": "Certificates and encryption",
  "url": "https://redis.io/docs/latest/operate/kubernetes/8.2.0/security/certificates/",
  "summary": "Manage TLS certificates, client certificates, and internode encryption for Redis Software on Kubernetes.",
  "content": "\nCertificates and encryption use Kubernetes Secrets and cert-manager integration to provision, distribute, and rotate the TLS certificates that Redis Software relies on. The operator distributes referenced certificates across every cluster node.\n\n## How certificates work on Redis for Kubernetes\n\n- **Cluster certificates** live in Kubernetes Secrets that the `RedisEnterpriseCluster` spec references. The operator distributes them to every cluster node.\n- **cert-manager** can issue and rotate certificates automatically.\n- **Client certificates** live in a Secret that the database references for mutual TLS authentication.\n- **Internode encryption** is configured on the REC spec. The operator places the certificates on each node.\n\n## What's the same as Redis Software\n\nThe underlying certificate roles, requirements, and TLS behavior are unchanged. For concepts and reference details, see the existing Redis Software docs:\n\n- [Certificate roles and types](https://redis.io/docs/latest/operate/rs/security/certificates) — which certificate is used for what.\n- [Create certificates](https://redis.io/docs/latest/operate/rs/security/certificates/create-certificates) — certificate requirements (SAN, CN, validity).\n- [Update certificates](https://redis.io/docs/latest/operate/rs/security/certificates/updating-certificates) — rotation considerations on Redis Software.\n- [Monitor certificates](https://redis.io/docs/latest/operate/rs/security/certificates/monitor-certificates) — certificate expiration alerts.\n- [Client certificate authentication](https://redis.io/docs/latest/operate/rs/security/certificates/certificate-based-authentication) — how the cluster validates client certificates.\n- [TLS protocols](https://redis.io/docs/latest/operate/rs/security/encryption/tls/tls-protocols) and [ciphers](https://redis.io/docs/latest/operate/rs/security/encryption/tls/ciphers) — protocol and cipher selection.\n- [Enable TLS](https://redis.io/docs/latest/operate/rs/security/encryption/tls/enable-tls) — TLS for management, replication, and client connections.\n- [Internode encryption](https://redis.io/docs/latest/operate/rs/security/encryption/internode-encryption) — purpose and scope.\n- [PEM encryption](https://redis.io/docs/latest/operate/rs/security/encryption/pem-encryption) — encrypted private keys.\n\n## What's different on Kubernetes\n\n- **You capture certificates in Kubernetes Secrets and reference them declaratively in the REC spec.** The operator applies them to the cluster through the Redis Software REST API — the same way certificates are applied on Redis Software, cluster-wide rather than file-by-file on each node.\n- **cert-manager can issue and rotate certificates automatically**, replacing manual rotation steps.\n\n## In this section\n\n- [Manage REC certificates](https://redis.io/docs/latest/operate/kubernetes/security/certificates/manage-rec-certificates) — configure cluster TLS certificates.\n- [cert-manager integration](https://redis.io/docs/latest/operate/kubernetes/security/certificates/cert-manager) — automate certificate issuance and rotation with cert-manager.\n- [Add client certificates](https://redis.io/docs/latest/operate/kubernetes/security/certificates/add-client-certificates) — enable client certificate authentication for databases.\n- [Internode encryption](https://redis.io/docs/latest/operate/kubernetes/security/certificates/internode-encryption) — enable encryption between cluster nodes.\n",
  "tags": ["docs","operate","kubernetes"],
  "last_updated": "2026-10-19T14:33:15-05:00",
  "children": [{"id":"operate/kubernetes/security/certificates/manage-rec-certificates","summary":"Install your own certificates to replace the self-signed certificates used by a Redis Enterprise cluster on Kubernetes.","title":"Manage Redis Enterprise cluster (REC) certificates","url":"https://redis.io/docs/latest/operate/kubernetes/8.2.0/security/certificates/manage-rec-certificates/"},{"id":"operate/kubernetes/security/certificates/cert-manager","summary":"Automate TLS certificate management for Redis for Kubernetes using cert-manager.","title":"Integrate cert-manager with Redis for Kubernetes","url":"https://redis.io/docs/latest/operate/kubernetes/8.2.0/security/certificates/cert-manager/"},{"id":"operate/kubernetes/security/certificates/add-client-certificates","summary":"Add client certificates to your REDB custom resource.","title":"Add client certificates","url":"https://redis.io/docs/latest/operate/kubernetes/8.2.0/security/certificates/add-client-certificates/"},{"id":"operate/kubernetes/security/certificates/internode-encryption","summary":"Enable encryption for communication between REC nodes and configure custom certificates.","title":"Enable internode encryption","url":"https://redis.io/docs/latest/operate/kubernetes/8.2.0/security/certificates/internode-encryption/"}]
}