Manage in-transit encryption

This page explains how to manage in-transit encryption for your instance.

For an overview of in-transit encryption for Memorystore for Valkey, see About in-transit encryption.

You can only enable in-transit encryption when you initially create your Memorystore for Valkey instance. In-transit encryption cannot be disabled for instances created in this way.

Create an instance with in-transit encryption

Console

Follow the steps at Create a Memorystore for Valkey instance.

gcloud

To create a Valkey instance that has in-transit encryption run the create command:

gcloud beta memorystore instances create INSTANCE \
--location=REGION_ID \
--psc-auto-connections=network=projects/PROJECT_ID/global/networks/NETWORK_ID,projectId=PROJECT_ID \
--replica-count=REPLICA_COUNT \
--node-type=NODE_TYPE \
--shard-count=SHARD_COUNT \
--transit-encryption-mode=server-authentication

Replace the following:

INSTANCE is the ID of the Memorystore for Valkey instance you're creating. Your instance ID must be 1 to 63 characters and use only lowercase letters, numbers, or hyphens. It must start with a lowercase letter and end with a lowercase letter or number.
REGION_ID is the region where you want the instance placed.
PROJECT_ID is the ID of the project where you want to create your instance.
NETWORK_ID is the ID of the network you want to use to create your instance.
REPLICA_COUNT is your desired number of replicas (per shard). Accepted values are 0, 1, and 2.
NODE_TYPE is your chosen node type. Accepted values are:
- shared-core-nano
- standard-small
- highmem-medium
- highmem-xlarge
For more details on node types and instance configurations, see Instance and node specification.
SHARD_COUNT determines the number of shards in your instance. Shard count determines the total memory capacity for storing instance data. To see more details about instance specification, see Instance and node specification.

For example:

gcloud beta memorystore instances create my-instance \
--location=us-central1 \
--psc-auto-connections=network=projects/PROJECT_ID/global/networks/NETWORK_ID,projectId=PROJECT_ID \
--replica-count=1 \
--node-type=highmem-medium \
--shard-count=3 \
--transit-encryption-mode=server-authentication

Download the certificate authorities

If in-transit encryption is enabled on your instance, you see the certificates of the Certificate Authority when you run the get-certificate-authority command:

gcloud beta memorystore instances get-certificate-authority INSTANCE

Replace the following:

INSTANCE is the ID of your Memorystore for Valkey instance.

The response body includes certificates for all applicable Certificate Authorities.

Install Certificate Authorities on your client

You must install your instance's Certificate Authorities on the connecting client. CA installation can vary depending on the client type. The steps below explain how to install a CA on a Compute Engine Linux VM.

Connect with SSH to your Compute Engine Linux client.
Create a file called server_ca.pem in your client:
```
sudo vim /tmp/server_ca.pem
```

Download Certificate Authorities and paste them into the previously created server_ca.pem file.

The text of the CAs must be formatted correctly. Your server_ca.pem file should look something like this:

Your file, as seen in the previous example, should use the following guidelines:

Copy the entire Certificate Authority including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
Make sure that the text of the CAs are completely left justified. There should be no spaces in front of any line of the CAs.
Each Certificate Authority should be added on a new line. No blank lines should exist between CAs.

Configure your client for in-transit encryption

The client that you use to connect to the instance must support TLS or use a third-party sidecar to enable TLS.

If your client supports TLS, configure it to point to your Valkey instance's IP, port 6379, and the file containing the Certificate Authority. If you choose to use a sidecar, we recommend using Stunnel.

Securely connect to a Memorystore instance using Stunnel and telnet

For instructions on using Stunnel to enable in-transit encryption on a Compute Engine client, see Securely connect to a Memorystore instance using Stunnel and telnet.

Manage Certificate Authority rotation

You should install all downloadable Certificate Authorities on clients accessing your instance.

Installing the new CAs, in addition to the previous CAs, once they become available is the simplest form of ensuring that you have the necessary CAs when the Certificate Authority rotation event occurs.

All you need to do to make sure that you have the required CA is to make sure that the CAs saved in your client file match those shown when downloading Certificate Authorities. Both new CAs and old CAs are active during rotation to ensure minimal downtime.

Code sample for connecting to an instance that uses in-transit encryption

To view a Valkey-compatible code sample on how to set up a client library to connect to an instance that uses in-transit encryption, see In-transit encryption client library code sample.