docker-redis-cluster icon indicating copy to clipboard operation
docker-redis-cluster copied to clipboard

Add TLS support.

Open bjosv opened this issue 3 years ago • 1 comments

This is a continuation of #99 and #103 to attempt to add support of TLS to docker-redis-cluster. Its basically the same as #103 with some small changes, and the cert files are removed from the PR.

  • When TLS is enabled, the regular TCP port is disabled (binded to port 0) and the configured port is used as a TLS only port.
  • This change has been tested by building all versions (invoke build all, i.e currently 3.0.0 to 6.2.1), and the BUILD_TLS flag only effects Redis 6 and forward.
  • Each built container has been tested OK when connecting using redis-cli both from within the container and from outside container.
  • Enabling TLS using the env. -e TLS=true only works for Redis 6. Older version will not handle the redis-cli flag -tls
  • Since there was problems regarding cert handling pre-6.0.6, TLS only works fine from Redis 6.0.6

This PR requires additional files to be created by the maintainer using the following steps

# Generate Certificate Authority's private key and cert
mkdir -p tls-certs
openssl genrsa -out tls-certs/ca.key 4096
openssl req \
    -x509 -new -nodes -sha256 \
    -key tls-certs/ca.key \
    -days 3650 \
    -subj '/O=Redis Cluster Test/CN=Certificate Authority' \
    -out tls-certs/ca.crt

# Generate Redis Cluster private key and a cert signed by CA
openssl genrsa -out tls-certs/redis.key 2048
openssl req \
    -new -sha256 \
    -key tls-certs/redis.key \
    -subj '/O=Redis Cluster Test/CN=Server' | \
    openssl x509 \
        -req -sha256 \
        -CA tls-certs/ca.crt \
        -CAkey tls-certs/ca.key \
        -CAserial tls-certs/ca.txt \
        -CAcreateserial \
        -days 3650 \
        -out tls-certs/redis.crt

# Adding needed files
git add tls-certs/ca.crt tls-certs/ca.key tls-certs/redis.crt tls-certs/redis.key

bjosv avatar Apr 27 '21 13:04 bjosv

CI fails due to the required files are not existing yet, i.e: tls-certs/ca.crt tls-certs/ca.key tls-certs/redis.crt tls-certs/redis.key

bjosv avatar Apr 27 '21 13:04 bjosv