Error: redis-cli certificate verify failed

Solution

What's Causing This Error

The error 'redis-cli certificate verify failed' occurs when Redis client (redis-cli) is unable to verify the SSL/TLS certificate provided by the Redis server. This error happens because either the certificate presented by the Redis server is not trusted or there might be an issue with the client configuration. When Redis client establishes a secure connection with the Redis server, it checks the certificate provided by the server against a list of trusted certificates stored on the client-side. If the certificate does not match the trusted list or if there is an issue with the client-side configuration, the client throws this error.

## Solution - Here's How To Resolve It
To resolve this error, you can follow these possible solutions:

### 1. Verify the Redis Server Certificate
Ensure that the Redis server has a valid SSL/TLS certificate issued by a recognized Certificate Authority (CA). Check the following:

• The certificate has not expired.
• The certificate's Common Name (CN) matches the hostname used in the connection.
• You can verify the certificate using the openssl command:
  ```bash
  openssl s_client -connect {REDIS_SERVER_HOSTNAME}:6379
  ```
  
  ### 2. Update Client Trust Store
  If the certificate is valid but not trusted on your client machine, you may need to add it to the client's trust store:
  ```bash
  certutil -addstore -f "ROOT" path_to_server_certificate.crt
  ```
  This command adds the server's certificate to the trusted root certificates store.
  
  ### 3. Configure redis-cli for SSL Connections
  To connect securely, configure redis-cli with the necessary SSL options:
  ```bash
  redis-cli --tls --cacert /path/to/ca.crt -h hostname -p port
  ```
  This command specifies the CA certificate that redis-cli should trust.
  
  ### 4. Ensure Hostname Matches
  Verify that the hostname in the SSL certificate matches the connection hostname. Mismatches between these can lead to verification failures.
  
  ### 5. Update System Trust Store
  Keep your system's trust store updated with the latest CA certificates to ensure it can verify newly issued certificates:
  ```bash
  update-ca-certificates
  ```
  
  ### 6. Disable Certificate Validation (Not Recommended)
  For troubleshooting purposes only, you can disable certificate validation:
  ```bash
  redis-cli --tls --insecure -h hostname -p port
  ```
  Note: Disabling certificate validation is insecure and should not be used in production environments.
  
  By following these steps, you should be able to resolve the 'redis-cli certificate verify failed' error and establish a secure connection between your Redis client and server.