Configure cipher suites

Shows how to configure cipher suites.

Ciphers are algorithms that help secure connections between clients and servers. You can change the ciphers to improve the security of your Redis Enterprise cluster and databases. The default settings are in line with industry best practices, but you can customize them to match the security policy of your organization.

TLS 1.2 cipher suites

Name Configurable Description
control_cipher_suites ✅ Yes Cipher list for TLS 1.2 communications for cluster administration (control plane)
data_cipher_list ✅ Yes Cipher list for TLS 1.2 communications between applications and databases (data plane)
sentinel_cipher_suites ✅ Yes Cipher list for discovery service (Sentinel) TLS 1.2 communications

TLS 1.3 cipher suites

Name Configurable Description
control_cipher_suites_tls_1_3 ❌ No Cipher list for TLS 1.3 communications for cluster administration (control plane)
data_cipher_suites_tls_1_3 ✅ Yes Cipher list for TLS 1.3 communications between applications and databases (data plane)
sentinel_cipher_suites_tls_1_3 ❌ No Cipher list for discovery service (Sentinel) TLS 1.3 communications

Configure cipher suites

You can configure ciphers with the Cluster Manager UI, rladmin, or the REST API.

Warning:
Configuring cipher suites overwrites existing ciphers rather than appending new ciphers to the list.

When you modify your cipher suites, make sure:

  • The configured TLS version matches the required cipher suites.
  • The certificates in use are properly signed to support the required cipher suites.
Note:

  • Redis Enterprise Software doesn't support static Diffie–Hellman (DH) key exchange ciphers.

  • It does support Ephemeral Diffie–Hellman (DHE or ECDHE) key exchange ciphers on Red Hat Enterprise Linux (RHEL) 8 and Bionic OS.

Edit cipher suites in the UI

To configure cipher suites using the Cluster Manager UI:

  1. Go to Cluster > Security, then select the TLS tab.

  2. In the Cipher suites lists section, click Configure:

    Cipher suites lists as shown in the Cluster Manager UI.

  3. Edit the TLS cipher suites in the text boxes:

    Edit cipher suites drawer in the Cluster Manager UI.

  4. Click Save.

Control plane cipher suites

As of Redis Enterprise Software version 6.0.12, control plane cipher suites can use the BoringSSL library format for TLS connections to the admin console. See the BoringSSL documentation for a full list of available BoringSSL configurations.

Configure TLS 1.2 control plane cipher suites

To configure TLS 1.2 cipher suites for cluster communication, use the following rladmin command syntax:

rladmin cluster config control_cipher_suites <BoringSSL cipher list>

See the example below to configure cipher suites for the control plane:

rladmin cluster config control_cipher_suites ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
Note:
  • The deprecated 3DES and RC4 cipher suites are no longer supported.

Data plane cipher suites

Data plane cipher suites use the OpenSSL library format in Redis Enterprise Software version 6.0.20 or later. For a list of available OpenSSL configurations, see Ciphers (OpenSSL).

Configure TLS 1.2 data plane cipher suites

To configure TLS 1.2 cipher suites for communications between applications and databases, use the following rladmin command syntax:

rladmin cluster config  data_cipher_list <OpenSSL cipher list>

See the example below to configure cipher suites for the data plane:

rladmin cluster config data_cipher_list AES128-SHA:AES256-SHA
Note:
  • The deprecated 3DES and RC4 cipher suites are no longer supported.

Configure TLS 1.3 data plane cipher suites

To configure TLS 1.3 cipher suites for communications between applications and databases, use the following rladmin command syntax:

rladmin cluster config data_cipher_suites_tls_1_3 <OpenSSL cipher list>

The following example configures TLS 1.3 cipher suites for the data plane:

rladmin cluster config data_cipher_suites_tls_1_3 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256

Discovery service cipher suites

Sentinel service cipher suites use the golang.org OpenSSL format for discovery service TLS connections in Redis Enterprise Software version 6.0.20 or later. See their documentation for a list of available configurations.

Configure TLS 1.2 discovery service cipher suites

To configure TLS 1.2 cipher suites for the discovery service cipher suites, use the following rladmin command syntax:

rladmin cluster config  sentinel_cipher_suites <golang cipher list>

See the example below to configure cipher suites for the sentinel service:

rladmin cluster config sentinel_cipher_suites TLS_RSA_WITH_AES_128_CBC_SHA:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
RATE THIS PAGE
Back to top ↑