{
  "id": "enable-tls",
  "title": "Enable TLS",
  "url": "https://redis.io/docs/latest/operate/rs/8.0/security/encryption/tls/enable-tls/",
  "summary": "Shows how to enable TLS.",
  "content": "\nYou can use TLS authentication for one or more of the following types of communication:\n\n- Communication from clients (applications) to your database\n- Communication from your database to other clusters for replication using [Replica Of](https://redis.io/docs/latest/operate/rs/databases/import-export/replica-of/)\n- Communication to and from your database to other clusters for synchronization using [Active-Active](https://redis.io/docs/latest/operate/rs/databases/active-active/_index.md)\n\n\nWhen you enable or turn off TLS, the change applies to new connections but does not affect existing connections. You must update TLS parameters in the client's connection configuration, then clients must close existing connections and reconnect to apply the change.\n\n\n## Enable TLS for client connections {#client}\n\n**Cluster Manager UI:**\n\nTo enable TLS for client connections using the Cluster Manager UI:\n\n1. From your database's **Security** tab, select **Edit**.\n\n1. Expand the **TLS - Transport Layer Security for secure connections** section, then select **On**.\n\n1. In the **Apply TLS for** section, select **Clients and databases + Between databases**.\n\n1. Select **Save**.\n\n**REST API:**\n\nYou can also enable TLS for client connections using the REST API.\n\nTo enable TLS for client connections during database creation, include `\"tls_mode\": \"enabled\"` when you [create a database](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/bdbs#post-bdbs-v1):\n\n```sh\nPOST https://\u003chost\u003e:\u003cport\u003e/v1/bdbs\n{\n  \"tls_mode\": \"enabled\",\n  // Additional fields\n}\n```\n\nFor additional database configuration fields, see the [BDB object](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/bdb) reference.\n\nTo enable TLS for client connections after database creation, you can use an [update database configuration](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/bdbs#put-bdbs) REST API request:\n\n```sh\nPUT https://\u003chost\u003e:\u003cport\u003e/v1/bdbs/\u003cdatabase_id\u003e\n{\n  \"tls_mode\": \"enabled\"\n}\n```\n\n\n\n### Enable mutual TLS\n\nOptionally, you can enable mutual TLS for client connections.\n\n**Cluster Manager UI:**\n\nTo enable mutual TLS using the Cluster Manager UI:\n\n1. Select **Mutual TLS (Client authentication)**.\n\n    \u003cimg src=\"../../../../../../images/rs/screenshots/databases/security-mtls-clients-7-8-2.png\" alt=\"Mutual TLS authentication configuration.\"\u003e\n\n1. For all clients, upload a client certificate, an intermediary certificate, or a trusted client CA certificate.\n\n    1. Click **+ Add certificate**.\n\n    1. Paste or upload the client certificate, intermediary certificate, or trusted client CA certificate.\n\n    1. Click **Done**.\n\n    If your database uses Replica Of, you also need to add the syncer certificates for the participating clusters. See [Enable TLS for Replica Of cluster connections](#enable-tls-for-replica-of-cluster-connections) for instructions.\n\n1. You can configure **Additional certificate validations** to further limit connections to clients with valid certificates.\n\n    Additional certificate validations occur only when loading a [certificate chain](https://en.wikipedia.org/wiki/Chain_of_trust#Computer_security) that includes the [root certificate](https://en.wikipedia.org/wiki/Root_certificate) and intermediate [CA](https://en.wikipedia.org/wiki/Certificate_authority) certificate but does not include a leaf (end-entity) certificate. If you include a leaf certificate, mutual client authentication skips any additional certificate validations.\n\n    1. Select a certificate validation option.\n\n        | Validation option | Description |\n        |-------------------|-------------|\n        | _No validation_ | Authenticates clients with valid certificates. No additional validations are enforced. |\n        | _By Subject Alternative Name_ | A client certificate is valid only if its Subject Alternative Name (SAN) DNS entries or Common Name (CN) match an entry in the list of valid subjects. Ignores other [`Subject`](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6) attributes. |\n        | _By full Subject Name_ | A client certificate is valid only if its [`Subject`](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6) attributes match an entry in the list of valid subjects. |\n\n    1. If you selected **No validation**, you can skip this step. Otherwise, select **+ Add validation** to create a new entry and then enter valid [`Subject`](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6) attributes for your client certificates. All `Subject` attributes are case-sensitive.\n\n        | Subject attribute\u003cbr /\u003e(case-sensitive) | Description |\n        |-------------------|-------------|\n        | _Common Name (CN)_ | Name of the client authenticated by the certificate (_required_) |\n        | _Organization (O)_ | The client's organization or company name |\n        | \u003cnobr\u003e_Organizational Unit (OU)_\u003c/nobr\u003e | Name of the unit or department within the organization |\n        | _Locality (L)_ | The organization's city |\n        | _State / Province (ST)_ | The organization's state or province |\n        | _Country (C)_ | 2-letter code that represents the organization's country |\n\n        You can only enter a single value for each field, except for the _Organizational Unit (OU)_ field. If your client certificate has a `Subject` with multiple  _Organizational Unit (OU)_ values, press the `Enter` or `Return` key after entering each value to add multiple Organizational Units.\n\n        \u003cimg src=\"../../../../../../images/rs/screenshots/databases/security-mtls-add-cert-validation-multi-ou.png\" width=\"350px\" alt=\"An example that shows adding a certificate validation with multiple organizational units.\"\u003e\n\n        **Breaking change:** If you use the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api) instead of the Cluster Manager UI to configure additional certificate validations, note that `authorized_names` is deprecated as of Redis Software v6.4.2. Use `authorized_subjects` instead. See the [BDB object reference](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/bdb) for more details.\n\n1. Select **Save**.\n\n**REST API:**\n\nYou can also enable mutual TLS using the REST API.\n\nTo enable mutual TLS during database creation, include the following fields when you [create a database](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/bdbs#post-bdbs-v1):\n\n```sh\nPOST https://\u003chost\u003e:\u003cport\u003e/v1/bdbs\n{\n  \"authorized_subjects\": [{\n    \"CN\": \u003cstring\u003e,\n    \"O\": \u003cstring\u003e,\n    \"OU\": [\u003carray of strings\u003e],\n    \"L\": \u003cstring\u003e,\n    \"ST\": \u003cstring\u003e,\n    \"C\": \u003cstring\u003e\n  }],\n  \"authentication_ssl_client_certs\": [{\n    \"client_cert\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\\n\"\n  }],\n  \"client_cert_subject_validation_type\": \u003c\"disabled\" | \"san_cn\" | \"full_subject\"\u003e,\n  \"enforce_client_authentication\": \"enabled\",\n  \"tls_mode\": \"enabled\",\n  // Additional fields\n}\n```\n\nFor additional database configuration fields, see the [BDB object](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/bdb) reference.\n\nTo enable mutual TLS after database creation, you can use an [update database configuration](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/bdbs#put-bdbs) REST API request:\n\n```sh\nPUT https://\u003chost\u003e:\u003cport\u003e/v1/bdbs/\u003cdatabase_id\u003e\n{\n  \"authorized_subjects\": [{\n    \"CN\": \u003cstring\u003e,\n    \"O\": \u003cstring\u003e,\n    \"OU\": [\u003carray of strings\u003e],\n    \"L\": \u003cstring\u003e,\n    \"ST\": \u003cstring\u003e,\n    \"C\": \u003cstring\u003e\n  }],\n  \"authentication_ssl_client_certs\": [{\n    \"client_cert\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\\n\"\n  }],\n  \"client_cert_subject_validation_type\": \u003c\"disabled\" | \"san_cn\" | \"full_subject\"\u003e,\n  \"enforce_client_authentication\": \"enabled\",\n  \"tls_mode\": \"enabled\"\n}\n```\n\n\n\n### Validate client certificate expiration\n\nBy default, Redis Software validates client certificate expiration dates.  You can use [`rladmin tune db`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/tune#tune-db) to turn off this behavior.\n\n```sh\nrladmin tune db \u003c db:id | name \u003e mtls_allow_outdated_certs { enabled | disabled }\n```\n\n### Connect over TLS\n\nTo connect to a Redis Software database over TLS using [`redis-cli`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/redis-cli):\n\n1. Download or copy the server (or proxy) certificate from the Cluster Manager UI (**Cluster \u003e Security \u003e Certificates \u003e Server authentication**) or from a cluster node (`/etc/opt/redislabs/proxy_cert.pem`).\n\n1. Copy the certificate to each client machine.\n\n1. If your database doesn't require client authentication with mutual TLS, provide the server certificate when you connect:\n\n    ```sh\n    redis-cli -h \u003cendpoint\u003e -p \u003cport\u003e --tls --cacert proxy_cert.pem\n    ```\n\n1. If your database requires client authentication with mutual TLS, provide your client's private and public keys along with the Redis Software server certificate when you connect:\n\n    ```sh\n    redis-cli -h \u003cendpoint\u003e -p \u003cport\u003e --tls --cacert proxy_cert.pem \\\n        --cert redis_user.crt --key redis_user_private.key\n    ```\n\n## Enable TLS for Active-Active cluster connections\n\nYou can enable TLS for Active-Active cluster connections when you create a database using the Cluster Manager UI, [`crdb-cli`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/crdb-cli), or the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api).\n\nIf you need to enable or turn off TLS after the Active-Active database is created, you must use [`crdb-cli`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/crdb-cli) or the [REST API](https://redis.io/docs/latest/operate/rs/references/rest-api).\n\n### Enable TLS during database creation\n\nTo enable TLS for Active-Active cluster connections using the Cluster Manager UI:\n\n1. During [database creation](https://redis.io/docs/latest/operate/rs/databases/active-active/create), expand the **TLS** configuration section.\n\n1. Select **On** to enable TLS.\n\n    ![images/rs/screenshots/databases/active-active-databases/enable-tls-for-active-active-db.png](https://redis.io/docs/latest/images/rs/screenshots/databases/active-active-databases/enable-tls-for-active-active-db.png)\n\n1. Click **Create**.\n\nIf you also want to require TLS for client connections during creation, you can use the [create an Active-Active database](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/crdbs/#post-crdb) REST API request to create an Active-Active database with TLS enabled for client connections.\nYou should configure the client certificates individually for each instance instead of using the default database configuration, even if the same certificate is used across all instances.\nThis allows you to rotate the certificates independently for each instance and to avoid outages in case of certificate expiration.\n\n```json\nPOST https://\u003chost\u003e:9443/v1/crdb\n{\n  \"name\": \"crdb-mtls\",\n  \"default_db_config\": {\n    \"name\": \"crdb-mtls\",\n    \"bigstore\": false,\n    \"memory_size\": 4294967296\n  },\n  \"encryption\": true,\n  \"instances\": [\n    {\n      \"cluster\": {\n        \"name\": \"\u003ccluster1_host\u003e\",\n        \"url\": \"https://\u003ccluster1_host\u003e:9443\",\n        \"credentials\": {\n          \"username\": \"\u003cusername\u003e\",\n          \"password\": \"\u003cpassword\u003e\"\n        }\n      },\n      \"db_config\": {\n        \"tls_mode\": \"enabled\",\n        \"enforce_client_authentication\": \"enabled\",\n        \"authentication_ssl_client_certs\": [\n          {\n            \"client_cert\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\\n\"\n          }\n        ]\n      }\n    },\n    {\n      \"cluster\": {\n        \"name\": \"\u003ccluster2_host\u003e\",\n        \"url\": \"https://\u003ccluster2_host\u003e:9443\",\n        \"credentials\": {\n          \"username\": \"\u003cusername\u003e\",\n          \"password\": \"\u003cpassword\u003e\"\n        }\n      },\n      \"db_config\": {\n        \"tls_mode\": \"enabled\",\n        \"enforce_client_authentication\": \"enabled\",\n        \"authentication_ssl_client_certs\": [\n          {\n            \"client_cert\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\\n\"\n          }\n        ]\n      }\n    }\n  ],\n  \"causal_consistency\": false\n}\n```\n\n### Enable TLS after database creation\n\nYou can enable TLS for an existing Active-Active database using either `crdb-cli` or the REST API.\n\n**CLI:**\n\nRun the following [`crdb-cli crdb update`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/crdb-cli/crdb/update) command:\n\n```sh\ncrdb-cli crdb update --crdb-guid \u003cguid\u003e --encryption true\n```\n\nReplace `\u003cguid\u003e` with your Active-Active database's globally unique identifier.\n\n**REST API:**\n\nYou can use an [update database configuration](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/bdbs#put-bdbs) request to enable TLS.\n\nTo enable TLS for Active-Active database communications only:\n\n```sh\nPUT https://\u003chost\u003e:9443/v1/bdbs/\u003cdatabase-id\u003e\n{\n  \"enforce_client_authentication\": \"disabled\",\n  \"tls_mode\": \"replica_ssl\"\n}\n```\n\nTo enable TLS for all communications:\n\n```sh\nPUT https://\u003chost\u003e:9443/v1/bdbs/\u003cdatabase-id\u003e\n{\n  \"enforce_client_authentication\": \"disabled\",\n  \"tls_mode\": \"enabled\"\n}\n```\n\n\n\n## Enable TLS for Replica Of cluster connections\n\nTo enable TLS for Replica Of cluster connections:\n\n1. For each cluster hosting a replica:\n\n    1. Go to **Cluster \u003e Security \u003e Certificates**.\n\n    1. Expand the **Replica Of and Active-Active authentication (Syncer certificate)** section.\n\n        ![images/rs/screenshots/cluster/security-syncer-cert.png](https://redis.io/docs/latest/images/rs/screenshots/cluster/security-syncer-cert.png)\n    \n    1. Download or copy the syncer certificate.\n\n1. From the **Security** tab of the Replica Of source database, select **Edit**.\n\n1. In the **TLS - Transport Layer Security for secure connections** section, make sure the checkbox is selected.\n\n1. In the **Apply TLS for** section, select **Between databases only**.\n\n1. Select **Mutual TLS (Client authentication)**.\n\n    ![images/rs/screenshots/databases/security-tls-replica-of.png](https://redis.io/docs/latest/images/rs/screenshots/databases/security-tls-replica-of.png)\n\n1. Select **+ Add certificate**, paste or upload the syncer certificate, then select **Done**.\n\n    Repeat this process, adding the syncer certificate for each cluster hosting a replica of this database.\n\n1. _(Optional)_ To require TLS for client connections, change **Apply TLS for** to **Clients and databases + Between databases** and add client certificates.\n\n1. Select **Save**.\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-07-23T12:00:25-05:00"
}