Manage in-transit encryption

This page explains how to enable in-transit encryption during Redis instance creation, and how to manage in-transit encryption for the instance. In-transit encryption uses the Transport Layer Security (TLS) protocol.

For information on the general behavior and benefits of using in-transit encryption, see In-transit encryption.

For a list of permissions that a user needs in order to perform the management tasks on this page, see In-transit encryption permissions.

You can only enable in-transit encryptions when you initially create your Redis instance. In-transit encryption cannot be disabled for instances created in this way.

Creating a Redis instance with in-transit encryption

Console

Select Enable in-transit encryption when Creating a Redis instance.

gcloud

To create a Redis instance that has in-transit encryption enter the following command, replacing variables with appropriate values:

gcloud redis instances create instance-id --transit-encryption-mode=SERVER_AUTHENTICATION --size=size --region=region-id

Where:

--transit-encryption-mode=SERVER_AUTHENTICATION enables in-transit encryption for your instance.

Downloading the Certificate Authority

Console

Go to the Memorystore for Redis page in the Google Cloud console.

Memorystore for Redis
View your instance's Instance details page by clicking on your Instance ID.
Click the Download or Download All button under TLS server certificate.

gcloud

If in-transit encryption is enabled on your instance, you see the contents of the Certificate Authority(ies) when you run the following command:

gcloud redis instances describe instance-id --region=region

The response body will include all applicable Certificate Authorities. The following is an example Certificate Authority (CA) for Memorystore for Redis:

Copy and save all of the CAs temporarily so you can install them on clients accessing the Redis instance.

Installing a Certificate Authority on your client

You must install your Redis instance's Certificate Authority(ies) on the connecting client. CA installation can vary depending on the client type. The steps below explain how to install a CA on a Compute Engine Linux VM.

Connect with SSH to your Compute Engine Linux client.
Create a file called server_ca.pem in your client by running the following command:
```
sudo vim /tmp/server_ca.pem
```
Download the Certificate Authority and paste it into the previously created server_ca.pem file.

The text of the CA must be formatted correctly:
- Copy the entire Certificate Authority including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
- Make sure that the text of the CA is completely left justified. There should be no spaces in front of any line of the CA.

Configuring your client for in-transit encryption

The client that you use to connect to the Redis instance must support TLS or use a third-party sidecar to enable TLS.

If your client supports TLS, configure it to point to your Redis instance's IP, port 6378, and the file containing the Certificate Authority. If you choose to use a sidecar, we recommend using Stunnel.

Additional client configuration

Some clients do not accept self-signed certificates by default and will require additional configuration.

For example, Lettuce is a popular Java client for Redis. Their documentation provides an example for connecting natively with TLS (see Example 47). Given that the Java Security Manager does not allow self-signed certificates by default, an additional option needs to be specified in the Redis URI construction .withVerifyPeer(false).

Securely connecting to a Redis instance using Stunnel and telnet

For instructions on using Stunnel to enable in-transit encryption on a Compute Engine client, see Securely connecting to a Redis instance using Stunnel and telnet.

Managing Certificate Authority rotation

You should install all downloadable Certificate Authorities on clients accessing the Redis instance.

Installing the new CA, in addition to the previous CA, once it becomes available is the simplest form of ensuring that you have the necessary CA when the Certificate Authority rotation event occurs.

Run the following command once a new Certificate Authority is introduced to view the contents of the new CA:

gcloud redis instances describe instance-id --region=region

Next, copy and paste the newest Certificate Authority into the file in your client in which you saved the previous CA.

The file should use the following format. The order of the CAs does not matter:

All you need to do to make sure that you have the required CA is to make sure that the CAs saved in your client file match those shown by gcloud redis instances describe. After a rotation event begins there are multiple CAs to ensure ample time for rotations with minimal downtime.

What's next

Read the overview for In-transit encryption.
Learn about the Redis AUTH feature on Memorystore for Redis.