ERR redis config_error ai_generated true

TLS error: certificate expired at <date>

ID: redis/tls-certificate-expired

Also available as: JSON · Markdown · 中文
90%Fix Rate
90%Confidence
1Evidence
2024-01-12First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
6.0.0 active — — —
7.0.0 active — — —
7.2.0 active — — —

Root Cause

The TLS certificate used by Redis (either server or client) has expired, causing the TLS handshake to fail and connections to be rejected.

generic

中文

Redis使用的TLS证书（服务器或客户端）已过期，导致TLS握手失败并拒绝连接。

Official Documentation

https://redis.io/docs/management/security/encryption/

Workarounds

  1. 95% success Generate a new self-signed certificate: `openssl req -x509 -newkey rsa:4096 -keyout /etc/redis/redis.key -out /etc/redis/redis.crt -days 365 -nodes` and update redis.conf with the new paths, then restart Redis. 
    Generate a new self-signed certificate: `openssl req -x509 -newkey rsa:4096 -keyout /etc/redis/redis.key -out /etc/redis/redis.crt -days 365 -nodes` and update redis.conf with the new paths, then restart Redis.
  2. 90% success If using a CA-signed certificate, renew the certificate via your CA and replace the cert files. Use `redis-cli --tls --cert /path/to/new/cert.pem --key /path/to/new/key.pem` to test the new certificate before restarting the server. 
    If using a CA-signed certificate, renew the certificate via your CA and replace the cert files. Use `redis-cli --tls --cert /path/to/new/cert.pem --key /path/to/new/key.pem` to test the new certificate before restarting the server.
  3. 40% success As a temporary measure, set the system clock back to a date within the certificate's validity period (not recommended for production), then restart Redis to allow connections while planning a proper renewal. 
    As a temporary measure, set the system clock back to a date within the certificate's validity period (not recommended for production), then restart Redis to allow connections while planning a proper renewal.

中文步骤

  1. 生成新的自签名证书：`openssl req -x509 -newkey rsa:4096 -keyout /etc/redis/redis.key -out /etc/redis/redis.crt -days 365 -nodes`，更新redis.conf中的路径，然后重启Redis。
  2. 如果使用CA签名证书，通过CA续期证书并替换证书文件。使用 `redis-cli --tls --cert /path/to/new/cert.pem --key /path/to/new/key.pem` 在重启服务器前测试新证书。
  3. 作为临时措施，将系统时钟设置回证书有效期内的日期（不推荐用于生产），然后重启Redis以允许连接，同时计划正式续期。

Dead Ends

Common approaches that don't work:

  1. 60% fail

    Disabling TLS entirely (e.g., port 6379 without tls-port) exposes data in transit and is not a real fix for environments requiring encryption.

  2. 80% fail

    Setting tls-auth-clients to 'no' bypasses client certificate validation but does not fix an expired server certificate; the server certificate must be renewed.