Enable TLS

Shows how to enable TLS.

You can use TLS authentication for one or more of the following types of communication:

  • Communication from clients (applications) to your database
  • Communication from your database to other clusters for replication using Replica Of
  • Communication to and from your database to other clusters for synchronization using Active-Active
Note:
When you enable or turn off TLS, the change applies to new connections but does not affect existing connections. Clients must close existing connections and reconnect to apply the change.

Enable TLS for client connections

To enable TLS for client connections:

  1. From your database's Security tab, select Edit.

  2. In the TLS - Transport Layer Security for secure connections section, make sure the checkbox is selected.

  3. In the Apply TLS for section, select Clients and databases + Between databases.

  4. Select Save.

To enable mutual TLS for client connections:

  1. Select Mutual TLS (Client authentication).

    Mutual TLS authentication configuration.

  2. For each client certificate, select + Add certificate, paste or upload the client certificate, then select Done.

    If your database uses Replica Of or Active-Active replication, you also need to add the syncer certificates for the participating clusters. See Enable TLS for Replica Of cluster connections or Enable TLS for Active-Active cluster connections for instructions.

  3. You can configure Additional certificate validations to further limit connections to clients with valid certificates.

    Additional certificate validations occur only when loading a certificate chain that includes the root certificate and intermediate CA certificate but does not include a leaf (end-entity) certificate. If you include a leaf certificate, mutual client authentication skips any additional certificate validations.

    1. Select a certificate validation option.

      Validation option Description
      No validation Authenticates clients with valid certificates. No additional validations are enforced.
      By Subject Alternative Name A client certificate is valid only if its Common Name (CN) matches an entry in the list of valid subjects. Ignores other Subject attributes.
      By full Subject Name A client certificate is valid only if its Subject attributes match an entry in the list of valid subjects.

    2. If you selected No validation, you can skip this step. Otherwise, select + Add validation to create a new entry and then enter valid Subject attributes for your client certificates. All Subject attributes are case-sensitive.

      Subject attribute
      (case-sensitive)      		 Description
      Common Name (CN) Name of the client authenticated by the certificate (required)
      Organization (O) The client's organization or company name
      Organizational Unit (OU) Name of the unit or department within the organization
      Locality (L) The organization's city
      State / Province (ST) The organization's state or province
      Country (C) 2-letter code that represents the organization's country

      You can only enter a single value for each field, except for the Organizational Unit (OU) field. If your client certificate has a Subject with multiple Organizational Unit (OU) values, press the Enter or Return key after entering each value to add multiple Organizational Units.

      An example that shows adding a certificate validation with multiple organizational units.

      Breaking change: If you use the REST API instead of the admin console to configure additional certificate validations, note that authorized_names is deprecated as of Redis Enterprise v6.4.2. Use authorized_subjects instead. See the BDB object reference for more details.

  4. Select Save.

    Note:

    By default, Redis Enterprise Software validates client certificate expiration dates. You can use rladmin to turn off this behavior.

    rladmin tune db < db:id | name > mtls_allow_outdated_certs enabled

Enable TLS for Active-Active cluster connections

To enable TLS for Active-Active cluster connections:

  1. If you are using the new admin console, switch to the legacy admin console.

    Select switch to legacy admin console from the dropdown.

  2. Retrieve syncer certificates.

  3. Configure TLS certificates for Active-Active.

  4. Configure TLS on all participating clusters.

Note:
You cannot enable or turn off TLS after the Active-Active database is created, but you can change the TLS configuration.

Retrieve syncer certificates

For each participating cluster, copy the syncer certificate from the general settings tab.

general-settings-syncer-cert

Configure TLS certificates for Active-Active

  1. During database creation (see Create an Active-Active Geo-Replicated Database, select Edit from the configuration tab.
  2. Enable TLS.
    • Enforce client authentication is selected by default. If you clear this option, you will still enforce encryption, but TLS client authentication will be deactivated.
  3. Select Require TLS for CRDB communication only from the dropdown menu. crdb-tls-all
  4. Select Add Add
  5. Paste a syncer certificate into the text box. Database TLS Configuration
  6. Save the syncer certificate. Save
  7. Repeat this process, adding the syncer certificate for each participating cluster.
  8. Optional: If also you want to require TLS for client connections, select Require TLS for All Communications from the dropdown and add client certificates as well.
  9. Select Update at the bottom of the screen to save your configuration.

Configure TLS on all participating clusters

Repeat this process on all participating clusters.

To enforce TLS authentication, Active-Active databases require syncer certificates for each cluster connection. If every participating cluster doesn't have a syncer certificate for every other participating cluster, synchronization will fail.

Enable TLS for Replica Of cluster connections

To enable TLS for Replica Of cluster connections:

  1. For each cluster hosting a replica:

    1. Go to Cluster > Security > Certificates.

    2. Expand the Replica Of and Active-Active authentication (Syncer certificate) section.

      Syncer certificate for Replica Of and Active-Active authentication.

    3. Download or copy the syncer certificate.

  2. From the Security tab of the Replica Of source database, select Edit.

  3. In the TLS - Transport Layer Security for secure connections section, make sure the checkbox is selected.

  4. In the Apply TLS for section, select Between databases only.

  5. Select Mutual TLS (Client authentication).

    Replica Of TLS authentication configuration.

  6. Select + Add certificate, paste or upload the syncer certificate, then select Done.

    Repeat this process, adding the syncer certificate for each cluster hosting a replica of this database.

  7. (Optional) To require TLS for client connections, change Apply TLS for to Clients and databases + Between databases and add client certificates.

  8. Select Save.

RATE THIS PAGE
Back to top ↑