Cache for Redis
Cache for Redis
Document
- Documentation
Cache for RedisUser guideData securityConnecting to Redis from client via SSL encryption
Copy page
Download PDFData security
Connecting to Redis from client via SSL encryption
Copy pageDownload PDFConnecting to Redis from client via SSL encryption
Cache for Redis provides SSL (Secure Sockets Layer) encryption service. You can enable SSL encryption in advance, and improve the security of the data link by setting SSL encryption when connecting to the database. This topic describes the specific methods for multilingual clients to access Redis databases via SSL encrypted connections.
Precautions
Accessing Redis instances through a private network is relatively secure, and typically requires no data link encryption. Using SSL encryption connection can increase the network response time of Redis services. We recommend that you enable SSL encryption only when necessary (such as when connecting to Redis instances via the internet).
Preparation
Before connecting to Redis via SSL encryption at client, you should make the following preparations.
Preparation | Description |
Setting SSL encryption for Redis | Enable SSL encryption for the target Redis instance and download the SSL CA certificate. For specific procedures, refer to Setting SSL encryption. |
Setting allowlist for Redis | Add the IP address of the local server or ECS instance with the client installed to the allowlist of the Redis instance. For specific procedures, refer to Setting allowlist. tip If your client device and Redis instance are not in the same VPC, you also need to enable public network access for the Redis instance. For specific procedures, refer to Applying for public address. |
Obtain database username information | Refer to the following steps to obtain the database login username and password for Cache for Redis:
tip If you forget your password, you can reset it. For specific procedures, refer to Resetting password. |
Obtain database connection information | You can follow these steps to obtain the connection address and port number information for Cache for Redis:
tip |
Examples of client SSL connection
tip
For more details about the usage instructions of the third-party SDK client program, refer to Instructions for using third-party SDK clients.
tip
The steps below are illustrated using Jedis client version 3.6.0 as an example. Recommend using the latest version.
import java.io.FileInputStream;
import java.io.InputStream;
import java.security.KeyStore;
import java.security.SecureRandom;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import org.apache.commons.pool2.impl.GenericObjectPoolConfig;
import redis.clients.jedis.Jedis;
import redis.clients.jedis.JedisPool;
public class JedisSSLTest {
private static SSLSocketFactory createTrustStoreSSLSocketFactory(String jksFile) throws Exception {
KeyStore trustStore = KeyStore.getInstance("jks");
InputStream inputStream = null;
try {
inputStream = new FileInputStream(jksFile);
trustStore.load(inputStream, null);
} finally {
inputStream.close();
}
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance("PKIX");
trustManagerFactory.init(trustStore);
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustManagers, new SecureRandom());
return sslContext.getSocketFactory();
}
public static void main(String[] args) throws Exception {
// redis-shzl8lsda9uaa****_ca_certificate.jks is the certificate file name.
final SSLSocketFactory sslSocketFactory = createTrustStoreSSLSocketFactory("redis-shzl8lsda9uaa****_ca_certificate.jks");
// The connection pool settings are the instance's connection address, port number, timeout settings, and password.
JedisPool pool = new JedisPool(new GenericObjectPoolConfig(), "redis-shzl8lsda9uaa****.redis.ivolces.com",
6379, 2000, "SslTest:Pwd@1234", 0, true, sslSocketFactory, null, null);
try (Jedis jedis = pool.getResource()) {
jedis.set("key", "value");
System.out.println(jedis.get("key"));
}
}
}
tip
The steps below are illustrated using redis-py client as an example. Recommend using the latest version.
- Connection to the connection pool
- #!/bin/pythonimport redis# Set up a connection pool, and replace the host, port, and password values with the address, port number, and password of the instance, respectively.# redis-shzl8lsda9uaa****_ca_certificate.pem is the certificate file name.pool = redis.ConnectionPool(connection_class=redis.connection.SSLConnection, max_connections=100,host="redis-shzl8lsda9uaa****.redis.ivolces.com", port=6379, password="SslTest:Pwd@1234",ssl_cert_reqs=True, ssl_ca_certs="redis-shzl8lsda9uaa****_ca_certificate.pem")client = redis.Redis(connection_pool=pool)client.set("hi", "redis")print client.get("hi")
- Regular connection
- #!/bin/pythonimport redis# Set connection information, and replace the host, port, and password values with the address, port number, and password of the instance, respectively.# redis-shzl8lsda9uaa****_ca_certificate.pem is the certificate file name.client = redis.Redis(host="redis-shzl8lsda9uaa****.redis.ivolces.com", port=6379,password="SslTest:Pwd@1234", ssl=True,ssl_cert_reqs="required", ssl_ca_certs="redis-shzl8lsda9uaa****_ca_certificate.pem")client.set("hello", "world")print client.get("hello")
tip
- The steps below are illustrated using predis client as an example. Recommend using the latest version.
- If you are using the phpredis client, refer to SSL/TLS with certification file for a connection example.
require __DIR__.'/predis/autoload.php';
/* Set connection information, and replace the host, port, and password values with the address, port number, and password of the instance, respectively.
redis-shzl8lsda9uaa****_ca_certificate.pem is the certificate file name. */
$client = new Predis\Client([
'scheme' => 'tls',
'host' => 'redis-shzl8lsda9uaa****.redis.ivolces.com',
'port' => 6379,
'password' => 'SslTest:Pwd@1234',
'ssl' => ['cafile' => 'redis-shzl8lsda9uaa****_ca_certificate.pem', 'verify_peer' => true, 'verify_peer_name' => false],
]);
$client->set("hello", "world");
print $client->get("hello")."\n";
tip
The steps below are illustrated using go-redis client as an example. Recommend using the latest version.
package main
import (
"crypto/tls"
"crypto/x509"
"fmt"
"io/ioutil"
"github.com/go-redis/redis"
)
func main() {
// redis-shzl8lsda9uaa****_ca_certificate.pem is the certificate file name.
bytes, err := ioutil.ReadFile("redis-shzl8lsda9uaa****_ca_certificate.pem")
if err != nil {
fmt.Printf("err:%v\n", err)
return
}
pool := x509.NewCertPool()
pool.AppendCertsFromPEM(bytes)
tlsConfig := &tls.Config{
RootCAs: pool,
// Hostname for certificate validation; a private network address is sufficient.
ServerName: "redis-shzl8lsda9uaa****.redis.ivolces.com",
}
// Instance connection address.
addr := "redis-shzl8lsda9uaa****.redis.ivolces.com"
// Instance password.
password := "SslTest:Pwd@1234"
client := redis.NewClient(&redis.Options{
Addr: addr,
TLSConfig: tlsConfig,
Password: password,
})
err = client.Set("hello", "world", 0).Err()
if err != nil {
fmt.Printf("err:%v\n", err)
return
}
val, err := client.Get("hello").Result()
if err != nil {
fmt.Printf("err:%v\n", err)
return
}
fmt.Printf("val:%s\n", val)
}
Last updated: 2026.02.09 14:20:01
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
