How to Connect to Managed Redis Over TLS Without Leaking Credentials

Managed Redis is often treated like a utility: point the app at a hostname, paste a password into the environment, and move on. That is risky when the database is remote. Credentials, commands, keys, and result data should not cross the network in plaintext.

Start with the simplest secure path: native TLS

DigitalOcean’s current guide recommends using native TLS in redis-cli when the client supports it, and using stunnel mainly when an older client or local application cannot speak TLS itself. DigitalOcean tutorial

Redis documents TLS support in Redis Open Source starting with version 6 when TLS is enabled at build time. Redis TLS docs The Redis CLI documentation also says redis-cli uses plain TCP by default and can enable SSL/TLS with the --tls option, plus --cacert or --cacertdir for trusted certificate bundles when needed. redis-cli docs

Before connecting, collect the right details

You need four values from your managed Redis provider: hostname, TLS port, username if the provider uses one, and password. If the provider uses a private certificate authority, you also need the CA bundle path. DigitalOcean’s tutorial notes that managed providers often expose a TLS listener on a dedicated port and may reject plaintext connections. DigitalOcean tutorial

Use redis-cli without putting the password in process arguments

The safer pattern is to pass the password through an environment variable for the one command session instead of putting it directly after -a where it can appear in shell history or process listings.

export REDISCLI_AUTH='replace-with-redis-password'
redis-cli -h managed_redis_hostname -p managed_redis_tls_port --tls ping

A healthy connection returns PONG. DigitalOcean’s guide uses redis-cli with --tls for the managed Redis TLS endpoint, and Redis documents rediss:// as the TLS URI scheme for redis-cli. DigitalOcean tutorial redis-cli docs

When to add a CA bundle

If your provider signs the Redis certificate with a public certificate authority trusted by the operating system, --tls may be enough. If the provider gives you a custom CA file, pass it explicitly with --cacert.

export REDISCLI_AUTH='replace-with-redis-password'
redis-cli -h managed_redis_hostname -p managed_redis_tls_port --tls --cacert /path/to/provider-ca.pem ping

Redis documents --cacert and --cacertdir for trusted root certificate configuration. redis-cli docs

Use stunnel only when you need a local plaintext socket

Stunnel is useful when an older Redis client lacks TLS support or another local application expects to connect to a plaintext localhost port. In that setup, the application talks to 127.0.0.1, and stunnel creates the encrypted outbound connection to managed Redis. DigitalOcean tutorial

A minimal stunnel service should verify the server certificate chain instead of blindly wrapping traffic. DigitalOcean’s guide describes enabling stunnel on Ubuntu and configuring it with certificate verification for the outbound TLS connection. DigitalOcean tutorial

[managed-redis]
client = yes
accept = 127.0.0.1:8000
connect = managed_redis_hostname:managed_redis_tls_port
verifyChain = yes
CApath = /etc/ssl/certs
checkHost = managed_redis_hostname

After the tunnel is running, the local Redis client connects to the localhost listener while stunnel handles encryption to the provider endpoint.

export REDISCLI_AUTH='replace-with-redis-password'
redis-cli -h 127.0.0.1 -p 8000 ping

Do not normalize insecure shortcuts

Avoid --insecure in production

Skipping certificate validation defeats one of the main reasons to use TLS: proving the server is the one you meant to reach. Use insecure modes only for short-lived lab debugging, then fix the CA or hostname issue.

Prefer private networking when available

TLS protects the connection, but network exposure still matters. If your provider offers private networking, firewall rules, allowlists, or VPC peering, use them so the database is not reachable from more places than necessary.

Rotate credentials after setup mistakes

If a password was pasted into shell history, committed to a file, sent in a ticket, or exposed through a process list, rotate it. A secure TLS tunnel does not repair a leaked credential.

Troubleshooting checklist

Handshake fails

Check that you are using the TLS port, not the plaintext port, and confirm that the hostname matches the certificate.

Certificate verification fails

Update the operating system CA store or pass the provider CA bundle with --cacert. Do not make --insecure permanent.

Authentication fails

Confirm the username/password format expected by your provider. Some managed Redis services use the default Redis user, while others provide a full connection string.

The app cannot use TLS

Use stunnel as a compatibility bridge, keep it bound to localhost, and monitor the service so a restart does not silently drop the tunnel.

The takeaway

For most modern clients, native redis-cli --tls is the cleanest way to connect to managed Redis securely. Stunnel is still valuable as a compatibility layer, but it should be configured with certificate verification and treated as part of the security boundary, not a magic wrapper around an insecure setup.

redis-cli --version
redis-cli --tls --askpass -h managed_redis_hostname -p managed_redis_tls_port --user default ping
export REDISCLI_AUTH='replace-with-redis-password'
redis-cli --tls -h managed_redis_hostname -p managed_redis_tls_port --user default --cacert /path/to/provider-ca.pem ping

openssl s_client -connect managed_redis_hostname:managed_redis_tls_port -servername managed_redis_hostname -verify_return_error </dev/null

sudo apt update
sudo apt install -y stunnel4 redis-tools ca-certificates

[managed-redis]
client = yes
accept = 127.0.0.1:8000
connect = managed_redis_hostname:managed_redis_tls_port
verifyChain = yes
CApath = /etc/ssl/certs
checkHost = managed_redis_hostname
sni = managed_redis_hostname

sudo systemctl enable --now stunnel4
sudo systemctl status stunnel4 --no-pager
journalctl -u stunnel4 -n 50 --no-pager
export REDISCLI_AUTH='replace-with-redis-password'
redis-cli -h 127.0.0.1 -p 8000 --user default ping

Featured image: Ethernet connector by Wikideas1, CC0/public domain dedication via Wikimedia Commons.