下载redis6.0.5,地址(http://download.redis.io/releases/redis-6.0.5.tar.gz
)
编译安装:
SSL作为Redis6的新特性,需要在编译时指定开启:
make BUILD_TLS=yes install(install待继续测试)
如果遇到报错“fatal error: jemalloc/jemalloc.h: No such file or directory”,处理方案是在make命令增加参数MALLOC=libc
如果遇到报错fatal error: openssl/ssl.h: No such file or directory centos,处理方案是安装ssl组件yum install openssl-devel
配置ssl
redis的配置文件redis.conf文件关于tls的配置情况如下(关于相关配置文件可以参考xx)
port 0
tls-port 22010
tls-cert-file /var/private/redis/ssl/keypairs/server/server-cert.pem
tls-key-file /var/private/redis/ssl/keypairs/server/server-key.pem
tls-ca-cert-file /var/private/redis/ssl/ca/ca-cert.pem
tls-ca-cert-dir /var/private/ssl/ca
tls-auth-clients yes
tls-ciphers AES128-GCM-SHA256
tls-prefer-server-ciphers yes
哨兵模式的配置
1、redis-server配置redis.conf(该配置主要为建立主从模式)
需要打开tls-replication(tls-replication yes)
2、redis-sentinel配置sentinel.conf
配置增加如下(虽然sentinel的配置文件没有这些选项,但是从源码查看sentinel继承于redis,redis的相关配置在sentinel可以继续工作)
port 0
tls-port 22011
tls-replication yes
tls-ca-cert-file "/var/private/ssl/ca/ca-cert.pem"
tls-ca-cert-dir "/var/private/ssl/ca"
tls-cert-file "/var/private/ssl/redis/server-cert.pem"
tls-key-file "/var/private/ssl/redis/server-key.pem"
参考地址
https://redis.io/topics/encryption