TLS Certificate

Generate an OpenSSL script for a Redis TLS self-signed certificate (for reference only). OpenSSL >= 3.2 is recommended (X.509 v3 by default).

Output: ca.key ca.crt redis.key redis.crt.

Use with Redis Docker Setup: copy the files into the /data/redis-*/cert directory noted in the install script.

SANCert CNValid Days

bash

# ================================================================
# Redis TLS (OpenSSL >= 3.2 recommended; X.509 v3 by default)
# Output: ca.key ca.crt redis.key redis.crt
# ================================================================

# ----------------------------------------------------------------
# Step 1: Generate CA (ca.key + ca.crt)
# ----------------------------------------------------------------
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha256 -days 36500 \
  -key ca.key -out ca.crt \
  -subj "/CN=Redis-CA/O=Redis" \
  -addext "basicConstraints=critical,CA:true" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"

# ----------------------------------------------------------------
# Step 2: Generate server key and CSR (with SAN)
# ----------------------------------------------------------------
openssl genrsa -out redis.key 4096
openssl req -new -sha256 -key redis.key -out redis.csr \
  -subj "/CN=redis/O=Redis" \
  -addext "subjectAltName=IP:127.0.0.1,DNS:localhost" \
  -addext "keyUsage=digitalSignature,keyEncipherment" \
  -addext "extendedKeyUsage=serverAuth,clientAuth"

# ----------------------------------------------------------------
# Step 3: Sign server certificate with CA
# ----------------------------------------------------------------
openssl x509 -req -sha256 -days 36500 \
  -in redis.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out redis.crt -copy_extensions copy

# ----------------------------------------------------------------
# Step 4: Verify
# ----------------------------------------------------------------
openssl verify -CAfile ca.crt redis.crt
openssl x509 -in redis.crt -noout -text | grep -E 'Version|Subject:|Alternative|IP Address|DNS'

TLS Certificate ​

TLS Certificate