Skip to content

RS: Added mtls_trusted_ca to the certificates table #1428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 21, 2025
Merged

RS: Added mtls_trusted_ca to the certificates table #1428

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2a245a0
DOC-1574 RS: Added mtls_trusted_ca to certificates table
rrelledge Apr 16, 2025
293ff2a
Merge branch 'main' into DOC-1574
rrelledge Apr 17, 2025
5b9f0de
DOC-1574 Feedback updates and copy edits for certificates overview
rrelledge Apr 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 18 additions & 13 deletions content/operate/rs/security/certificates/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,21 +11,26 @@ linkTitle: Certificates
weight: 60
---

Redis Enterprise Software uses self-signed certificates by default to ensure that the product is secure. If using a self-signed certificate is not the right solution for you, you can import a certificate signed by a certificate authority of your choice.
Redis Enterprise Software uses self-signed certificates by default to ensure that the product is secure. These certificates are autogenerated on the first node of each Redis Enterprise Software installation and are copied to all other nodes added to the cluster.

Here's the list of self-signed certificates that create secure, encrypted connections to your Redis Enterprise cluster:
You can replace a self-signed certificate with one signed by a certificate authority of your choice.

| Certificate name | Description |
|------------------|-------------|
| `api` | Encrypts [REST API]({{< relref "/operate/rs/references/rest-api/" >}}) requests and responses. |
| `cm` | Secures connections to the Redis Enterprise Cluster Manager UI. |
| `ldap_client` | Secures connections between LDAP clients and LDAP servers. |
| `metrics_exporter` | Sends Redis Enterprise metrics to external [monitoring tools]({{< relref "/operate/rs/monitoring/" >}}) over a secure connection. |
| `proxy` | Creates secure, encrypted connections between clients and databases. |
| `syncer` | For [Active-Active]({{< relref "/operate/rs/databases/active-active/" >}}) or [Replica Of]({{< relref "/operate/rs/databases/import-export/replica-of/" >}}) databases, encrypts data during the synchronization of participating clusters. |
## Supported certificates

These self-signed certificates are generated on the first node of each Redis Enterprise Software installation and are copied to all other nodes added to the cluster.
Here's the list of supported certificates that create secure, encrypted connections to your Redis Enterprise Software cluster:

When you use the default self-signed certificates and you connect to the Cluster Manager UI over a web browser, you'll see an untrusted connection notification.
| Certificate name | Autogenerated | Description |
|------------------|:---------------:|-------------|
| `api` | <span title="Yes">&#x2705;</span> | Encrypts [REST API]({{< relref "/operate/rs/references/rest-api/" >}}) requests and responses. |
| `cm` | <span title="Yes">&#x2705;</span> | Secures connections to the Redis Enterprise Cluster Manager UI. |
| `ldap_client` | <span title="No">:x:</span> | Secures connections between LDAP clients and LDAP servers. |
| `metrics_exporter` | <span title="Yes">&#x2705;</span> | Sends Redis Enterprise metrics to external [monitoring tools]({{< relref "/operate/rs/monitoring/" >}}) over a secure connection. |
| `mtls_trusted_ca` | <span title="No">:x:</span> | Required to enable certificate-based authentication for secure, passwordless access to the REST API. |
| `proxy` | <span title="Yes">&#x2705;</span> | Creates secure, encrypted connections between clients and databases. |
| `syncer` | <span title="Yes">&#x2705;</span> | For [Active-Active]({{< relref "/operate/rs/databases/active-active/" >}}) or [Replica Of]({{< relref "/operate/rs/databases/import-export/replica-of/" >}}) databases, encrypts data during the synchronization of participating clusters. |

Depending on your browser, you can allow the connection for each session or add an exception to trust the certificate for all future sessions.
Certificates that are not autogenerated are optional unless you want to use certain features. For example, you must provide your own `ldap_client` certificate to enable [LDAP authentication]({{<relref "/operate/rs/security/access-control/ldap">}}) or an `mtls_trusted_ca` certificate to enable certificate-based authentication.

## Accept self-signed certificates to access the Cluster Manager UI

When you use the default self-signed certificates and you connect to the Cluster Manager UI over a web browser, you'll see an untrusted connection notification. Depending on your browser, you can allow the connection for each session or add an exception to trust the certificate for all future sessions.