To enable TLS in Redis, give the server a certificate, a key and a CA file, set tls-port, and set port to 0 so plaintext stops. Then add tls-replication for replicas and tls-cluster for the cluster bus. Clients must connect with TLS settings too.
What TLS does and does not cover
Redis authentication sends the AUTH command like any other command, unencrypted. The Redis security documentation says this means a password does not protect you from someone who can eavesdrop on the network. TLS closes that gap. It encrypts client connections, replication links and the cluster bus, so credentials and data are not readable in transit.
TLS is supported from Redis 6 as an optional feature that has to be enabled at compile time. Packages and managed services often ship with it built in, but if you compile Redis yourself you build with TLS support enabled and need the OpenSSL development libraries.
Steps
- Get a server certificate and private key, and the CA certificate that signs the certificates your clients will present.
- Set the three file directives: tls-cert-file, tls-key-file and tls-ca-cert-file. A DH parameters file is optional.
- Set tls-port to the TLS port. Redis can serve TLS and plaintext at the same time on different ports.
- Set port to 0 so the plaintext listener is closed. To serve TLS only on the default port, the documentation uses port 0 and tls-port 6379.
- Decide on client certificates. By default Redis uses mutual TLS and requires clients to present a valid certificate. The setting tls-auth-clients no turns that off.
- On each replica, set tls-replication to yes, so its outbound connection to the primary uses TLS.
- If you run Redis Cluster, set tls-cluster to yes for the cluster bus and cross-node connections.
- Sentinel inherits its network settings from the common configuration and uses tls-replication to decide whether connections to masters use TLS.
Settings at a glance
| Goal | Setting |
|---|---|
| Accept TLS clients | tls-port |
| Close plaintext | port set to 0 |
| Require client certificates | Default, controlled by tls-auth-clients |
| TLS on replica links | tls-replication yes (on replicas) |
| TLS on the cluster bus | tls-cluster yes |
Mistakes to check for
- Leaving the plaintext port open. If you add tls-port but keep port, clients can still connect without encryption, and your encryption story is only partly true.
- Enabling TLS on the primary but forgetting replicas. A replica without tls-replication yes will attempt a plaintext link.
- Skipping the cluster bus. Cluster nodes talk on their own port, so tls-cluster matters in addition to client TLS.
- Treating TLS as authentication. It proves who the client is only if you require client certificates. Pair it with named users and ACLs, as covered in Redis ACL users: replace the default user nopass.
What it costs
Redis documentation says TLS adds overhead for reading and writing on an encrypted connection, so achievable throughput per instance goes down. Redis 8.0 added I/O threading with TLS. Test with your own workload and size instances accordingly rather than assuming a number.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a technical control like encryption in transit can be mapped to a framework requirement, since auditors often ask for exactly this evidence.
Safeguard's compliance and evidence automation can help organise the evidence for controls like this, and its asset discovery helps you find Redis hosts you forgot. Try the free scan.
Quick check
If I set tls-port, is plaintext Redis automatically disabled?
No. The documentation says tls-port is in addition to the normal port. Set port to 0 to disable plaintext.
Do replicas need separate TLS settings?
Yes. Set tls-replication to yes on the replica so its outgoing connection to the primary uses TLS.
Sources
Last reviewed: 19 October 2026.
