Ciphers are algorithms that help secure connections between clients and servers. You can change the ciphers to improve the security of your Redis Enterprise cluster and databases. The default settings are in line with industry best practices, but you can customize them to match the security policy of your organization.

Configure cipher suites

The communications for which you can modify ciphers are:

  • Control plane - The TLS configuration for cluster administration.
  • Data plane - The TLS configuration for the communication between applications and databases.
  • Discovery service (Sentinel) - The TLS configuration for the discovery service.

You can configure ciphers with the rladmin commands shown here or with the REST API.

Warning -
Configuring cipher suites overwrites existing ciphers rather than appending new ciphers to the list.

When you modify your cipher suites, make sure:

  • The configured TLS version matches the required cipher suites.
  • The certificates in use are properly signed to support the required cipher suites.
Note:

  • Redis Enterprise Software doesn’t support static Diffie–Hellman (DH) key exchange ciphers.

  • It does support Ephemeral Diffie–Hellman (DHE or ECDHE) key exchange ciphers on Red Hat Enterprise Linux (RHEL) 8 and Bionic OS.

Control plane

As of Redis Enterprise Software version 6.0.12, control plane cipher suites can use the BoringSSL library format for TLS connections to the admin console. See the BoringSSL documentation for a full list of available BoringSSL configurations.

To configure the cipher suites for cluster communication, use the following rladmin command syntax:

rladmin cluster config cipher_suites <BoringSSL cipher list>

See the example below to configure cipher suites for the control plane:

rladmin cluster config cipher_suites ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305

Data plane

Data plane cipher suites use the OpenSSL library format in Redis Enterprise Software version 6.0.20 or later. For a list of available OpenSSL configurations, see Ciphers (OpenSSL).

To configure the cipher suites for communications between applications and databases, use the following rladmin command syntax:

rladmin cluster config  data_cipher_list <OpenSSL cipher list>

See the example below to configure cipher suites for the data plane:

rladmin cluster config data_cipher_list AES128-SHA:AES256-SHA

Discovery service

Sentinel service cipher suites use the golang.org OpenSSL format for discovery service TLS connections in Redis Enterprise Software version 6.0.20 or later. See their documentation for a list of available configurations.

To configure the discovery service cipher suites, use the following rladmin command syntax:

rladmin cluster config  sentinel_cipher_suites <golang cipher list>

See the example below to configure cipher suites for the sentinel service:

rladmin cluster config sentinel_cipher_suites TLS_RSA_WITH_AES_128_CBC_SHA:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384