All Products
Search
Document Center

ApsaraDB for Redis:Configure SSL encryption

Last Updated:Dec 21, 2023

This topic describes how to enable SSL encryption for an instance to enhance link security. After you enable SSL encryption, you must install SSL certificates that are issued by certificate authorities (CAs) on your application. SSL encryption can encrypt connections at the transport layer to increase data security and ensure data integrity.

Prerequisites

  • The instance is deployed in local disk mode.

  • The instance is a cluster instance that runs Redis 4.0 or 5.0. For more information, see Cluster master-replica instances.

Precautions

  • ApsaraDB for Redis upgrades SSL encryption to Transport Layer Security (TLS) encryption. As of April 7, 2023, you cannot enable SSL encryption for your instance. If you have enabled SSL encryption for your instance, you can disable SSL encryption or continue to use SSL encryption. After you disable SSL for your instance, you can no longer enable SSL encryption for the instance. For more information, see Encryption upgrade from SSL to TLS.

    Note

    We recommend that you use TLS encryption to increase data security. For more information, see Enable TLS encryption. Before you can enable TLS encryption for an instance, you must update the engine version of the instance to Redis 5.0.

  • An SSL certificate remains valid for one year. Before the used SSL certificate expires, you must update its validity period. In addition, you must download the required SSL certificate file and configure the certificate again. Otherwise, clients cannot connect to your instance over an encrypted connection.

  • SSL encryption may cause higher network latency for ApsaraDB for Redis instances. Therefore, we recommend that you enable this feature only when encryption is needed. For example, if you connect to an instance of ApsaraDB for Redis over the Internet, you can enable SSL encryption for the instance.

  • After you enable SSL encryption for an instance, both SSL and non-SSL connections are supported.

Procedure

  1. Log on to the ApsaraDB for Redis console and go to the Instances page. In the top navigation bar, select the region in which the instance that you want to manage resides. Then, find the instance and click the instance ID.

  2. In the left-side navigation pane, click TLS Settings (SSL).

  3. Perform one of the following operations based on your business needs.

    Operation

    Description

    Enable or disable SSL encryption

    Turn on or off SSL Certificate.

    Update the CA certificate

    Click Update Validity in the upper-right corner of the page and then click OK.

    The CA certificate remains valid for one year. You can click Update Validity and then download and configure the CA certificate again. After the CA certificate is updated, it is valid for another year.

    Download the CA certificate

    In the upper-right corner, click Download SSL Certificate.

    Warning

    The instance restarts after you enable SSL encryption or update the certificate validity period. The instance may encounter a transient connection that lasts for a few seconds. We recommend that you perform this operation during off-peak hours and make sure that your application can automatically reconnect to the instance.

FAQ

  • Q: What do I do if the error message "version not supported" is reported?

    A: You must update your instance to the latest minor version. For more information, see Update the minor version.

  • Q: What files are included in the downloaded CA certificate?

    A: The downloaded CA certificate is a compressed package that consists of the following files:

    • ApsaraDB-CA-Chain.p7b: This file is used to import the CA certificate into the Windows operating system.

    • ApsaraDB-CA-Chain.pem: This file is used to import the CA certificate into other operating systems such as Linux or applications.

    • ApsaraDB-CA-Chain.jks: This file stores truststore certificates of Java and is used to import the CA certificate chain into Java applications.

Methods to establish SSL connections

Related API operations

API operation

Description

ModifyInstanceSSL

Modifies the SSL encryption settings for an instance.