{
  "id": "certificates",
  "title": "Certificates and encryption",
  "url": "https://redis.io/docs/latest/operate/kubernetes/security/certificates/",
  "summary": "Manage TLS certificates, client certificates, and internode encryption for Redis Software on Kubernetes.",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-07-24T10:52:10-07:00",
  "children": [
    {
      "id": "manage-rec-certificates",
      "summary": "Install your own certificates to replace the self-signed certificates used by a Redis Enterprise cluster on Kubernetes.",
      "title": "Manage Redis Enterprise cluster (REC) certificates",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/certificates/manage-rec-certificates/"
    },
    {
      "id": "cert-manager",
      "summary": "Automate TLS certificate management for Redis for Kubernetes using cert-manager.",
      "title": "Integrate cert-manager with Redis for Kubernetes",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/certificates/cert-manager/"
    },
    {
      "id": "add-client-certificates",
      "summary": "Add client certificates to your REDB custom resource.",
      "title": "Add client certificates",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/certificates/add-client-certificates/"
    },
    {
      "id": "internode-encryption",
      "summary": "Enable encryption for communication between REC nodes and configure custom certificates.",
      "title": "Enable internode encryption",
      "url": "https://redis.io/docs/latest/operate/kubernetes/security/certificates/internode-encryption/"
    }
  ],
  "page_type": "content",
  "content_hash": "6ef0ee4696ba0ed800b4afb372f52409ca895ada79adcf5d9a570816011c3caf",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Certificates and encryption use Kubernetes Secrets and cert-manager integration to provision, distribute, and rotate the TLS certificates that Redis Software relies on. The operator distributes referenced certificates across every cluster node."
    },
    {
      "id": "how-certificates-work-on-redis-for-kubernetes",
      "title": "How certificates work on Redis for Kubernetes",
      "role": "content",
      "text": "- **Cluster certificates** live in Kubernetes Secrets that the `RedisEnterpriseCluster` spec references. The operator distributes them to every cluster node.\n- **cert-manager** can issue and rotate certificates automatically.\n- **Client certificates** live in a Secret that the database references for mutual TLS authentication.\n- **Internode encryption** is configured on the REC spec. The operator places the certificates on each node."
    },
    {
      "id": "what-s-the-same-as-redis-software",
      "title": "What's the same as Redis Software",
      "role": "content",
      "text": "The underlying certificate roles, requirements, and TLS behavior are unchanged. For concepts and reference details, see the existing Redis Software docs:\n\n- [Certificate roles and types](https://redis.io/docs/latest/operate/rs/security/certificates) — which certificate is used for what.\n- [Create certificates](https://redis.io/docs/latest/operate/rs/security/certificates/create-certificates) — certificate requirements (SAN, CN, validity).\n- [Update certificates](https://redis.io/docs/latest/operate/rs/security/certificates/updating-certificates) — rotation considerations on Redis Software.\n- [Monitor certificates](https://redis.io/docs/latest/operate/rs/security/certificates/monitor-certificates) — certificate expiration alerts.\n- [Client certificate authentication](https://redis.io/docs/latest/operate/rs/security/certificates/certificate-based-authentication) — how the cluster validates client certificates.\n- [TLS protocols](https://redis.io/docs/latest/operate/rs/security/encryption/tls/tls-protocols) and [ciphers](https://redis.io/docs/latest/operate/rs/security/encryption/tls/ciphers) — protocol and cipher selection.\n- [Enable TLS](https://redis.io/docs/latest/operate/rs/security/encryption/tls/enable-tls) — TLS for management, replication, and client connections.\n- [Internode encryption](https://redis.io/docs/latest/operate/rs/security/encryption/internode-encryption) — purpose and scope.\n- [PEM encryption](https://redis.io/docs/latest/operate/rs/security/encryption/pem-encryption) — encrypted private keys."
    },
    {
      "id": "what-s-different-on-kubernetes",
      "title": "What's different on Kubernetes",
      "role": "content",
      "text": "- **You capture certificates in Kubernetes Secrets and reference them declaratively in the REC spec.** The operator applies them to the cluster through the Redis Software REST API — the same way certificates are applied on Redis Software, cluster-wide rather than file-by-file on each node.\n- **cert-manager can issue and rotate certificates automatically**, replacing manual rotation steps."
    },
    {
      "id": "in-this-section",
      "title": "In this section",
      "role": "content",
      "text": "- [Manage REC certificates](https://redis.io/docs/latest/operate/kubernetes/security/certificates/manage-rec-certificates) — configure cluster TLS certificates.\n- [cert-manager integration](https://redis.io/docs/latest/operate/kubernetes/security/certificates/cert-manager) — automate certificate issuance and rotation with cert-manager.\n- [Add client certificates](https://redis.io/docs/latest/operate/kubernetes/security/certificates/add-client-certificates) — enable client certificate authentication for databases.\n- [Internode encryption](https://redis.io/docs/latest/operate/kubernetes/security/certificates/internode-encryption) — enable encryption between cluster nodes."
    }
  ],
  "examples": []
}