{
  "id": "pem-encryption",
  "title": "Encrypt private keys",
  "url": "https://redis.io/docs/latest/operate/rs/8.0/security/encryption/pem-encryption/",
  "summary": "Enable PEM encryption to encrypt all private keys on disk.",
  "content": "\nEnable PEM encryption to automatically encrypt all private keys on disk. Public keys (`.cert` files) are not encrypted.\n\nWhen certificates are rotated, the encrypted private keys are also rotated.\n\n## Enable PEM encryption\n\nTo enable PEM encryption and encrypt private keys on the disk, use [`rladmin`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin) or the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api).\n\n\n- [`rladmin cluster config`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/config):\n\n    ```sh\n    rladmin cluster config encrypt_pkeys enabled\n    ```\n\n- [Update cluster settings](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster#put-cluster) REST API request:\n\n    ```sh\n    PUT /v1/cluster\n    { \"encrypt_pkeys\": true }\n    ```\n\n## Deactivate PEM encryption\n\nTo deactivate PEM encryption and decrypt private keys on the disk, use [`rladmin`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin) or the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api).\n\n- [`rladmin cluster config`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/config):\n\n    ```sh\n    rladmin cluster config encrypt_pkeys disabled\n    ```\n\n- [Update cluster settings](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster#put-cluster) REST API request:\n\n    ```sh\n    PUT /v1/cluster\n    { \"encrypt_pkeys\": false }\n    ```\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-07-23T11:57:56-05:00"
}