SSL/TLS with certification file

[bluemmb]

Expected behaviour

Connect to encrypted connection with certification file

Actual behaviour

--

I'm seeing this behaviour on

• OS: *
• Redis: *
• PHP: *
• phpredis: *

Steps to reproduce, backtrace or example script

--

I can see that connecting to encrypted connections is discussed and supported here #1314 and #1561, but still i don't know how to set the certification file path to this plugin ? am I missing something ?

[yatsukhnenko]

@bluemmb unfortunately there is no way to do this right now.

[bluemmb]

@yatsukhnenko Thanks for the answer and the great work you have done on this repository.

Is there a default path for the file ? or can I read the file and pass it as a parameter or something to the plugin ? ( because there should be a key for the encryption anyway )

I have written an app and put it on the ibm cloud for my client. Because this plugin lacks this feature I had to go with predis. It is also very good library but latency of cloud network (~ 0.9ms) + overhead of the plain php code causes an undesirable latency for using Redis ( as I am testing things since the last week, there is not much of a difference between using redis or mysql with these conditions ) + I should mention that I am not sure that if C code's speed can help on this ?

Also I really like performance and I think it is not good that php lacks this important thing in the toolset. So do you have any suggestion ? Or is there any plan on doing this ? If neither, where can I start to work on helping to add this feature to this repo ?

[yatsukhnenko]

Is there a default path for the file ? or can I read the file and pass it as a parameter or something to the plugin ?

We use PHP stream wrapper so you may try to find default parameters somewhere in sources of PHP-engine.

Or is there any plan on doing this ? If neither, where can I start to work on helping to add this feature to this repo ?

It would be great to add ability to manage parameters of ssl/tls connections. We need to path them into redis_sock_connect in some way (as arguments or via INI variables) and handle whule creating connection.
I thought that we need to rewrite connect to handle array of parameters but @michael-grunder was against to make such big change because it will add more complexity to code and may break applications for users.

[Tommuh]

You could use Spiped to make the connection secure. I have done it with master/slave and sentinels.
I think Redis shouldn't implement this because it add an extra layer that can go wrong.
Keep doing what you're good at and let others do what they're good at.

https://www.tarsnap.com/spiped.html
https://redis.io/topics/encryption

[gabfl]

SSL/TLS is supported by Redis starting with version 6 as seen on https://redis.io/topics/encryption

Would it be possible to implement this feature in phpredis now that it is supported by Redis itself?

[yatsukhnenko]

@bluemmb @gabfl could you test issue-1600 branch? You can specify ssl context options as last argument in Redis::connect, for example:

$r = new Redis();
$r->connect('tls://github.com', 443, 0, null, 0, 0, [
  'local_cert' => '/path/to/cert.pem',
]);

[gabfl]

@yatsukhnenko Thank you very much for taking the time to write a patch, it is very appreciated

I staged your branch:

# Stage test branch
git clone https://github.com/phpredis/phpredis.git && cd phpredis
git fetch origin issue-1600
git checkout issue-1600

And compiled phpredis from it:

phpize
./configure
make && make install
echo "extension=redis.so" >> /etc/php/7.2/cli/conf.d/redis.ini

I used this php snippet:

<?php

$r = new Redis();
$r->connect('tls://127.0.0.1', 6379, 0, null, 0, 0, [
  'local_cert' => '/root/redis-6.0.3/tests/tls/redis.crt',
  'local_pk' => '/root/redis-6.0.3/tests/tls/redis.key',
  'cafile' => '/root/redis-6.0.3/tests/tls/ca.crt',
  'verify_peer_name' => false
]);

var_dump($r->set('test_tls', 'it works'));
var_dump($r->get('test_tls'));

and it works:

root@ubuntu-s-4vcpu-8gb-nyc1-01:~/phpredis# php phpredis.php
bool(true)
string(8) "it works"
root@ubuntu-s-4vcpu-8gb-nyc1-01:~/phpredis# 

🎉

[ywarnier]

Would there be any way to use TLS and a CA certificate in php.ini (session.save_path)?

[yatsukhnenko]

@ywarnier could you create another issue for session+tls?

[yatsukhnenko]

Fixed in 5.3.0.

[ywarnier]

@yatsukhnenko Issue #1775 is actually about that already.

[dimovnike]

the example is not working, the correct way to use it is:

$r->connect('tls://127.0.0.1', 6379, 0, null, 0, 0, [
  'stream' => [
    'local_cert' => '/root/redis-6.0.3/tests/tls/redis.crt',
    'local_pk' => '/root/redis-6.0.3/tests/tls/redis.key',
    'cafile' => '/root/redis-6.0.3/tests/tls/ca.crt',
    'verify_peer_name' => false
  ]
]);

Note the key 'stream'. Could not find this in the documentation.

[yatsukhnenko]

@dimovnike thanks! I made this example while Michael making his part related to acl. We will update documentation or maybe change api again 😄

[gabfl]

It worked for me as provided, it might be related to the PHP version in use

[dimovnike]

any idea why this client uses tlsv1 only? otherwise , the curl says it supports tlsv1.2.

[yatsukhnenko]

@dimovnike you can specify version tlsv1.2://

[AlexAndBear]

@yatsukhnenko I can't find anything in the documentation about the tls/ssl stuff and how to pass the arguments correctly, do you have a link for me ?

I encountered a inconsistency in this case, and I wondering why.

If we use the class Redis, we need to pass the following arguments:

	['stream' => [
				'local_cert' => '/home/jan/Downloads/redis-6.0.10/tests/tls/redis.crt',
				'local_pk' => '/home/jan/Downloads/redis-6.0.10/tests/tls/redis.key',
				'cafile' => '/home/jan/Downloads/redis-6.0.10/tests/tls/ca.crt',
				'verify_peer_name' => false
			]]

But if we use the RedisCluster class we need to provide the same arguments without the stream key

 [
				'local_cert' => '/home/jan/Downloads/redis-6.0.10/tests/tls/redis.crt',
				'local_pk' => '/home/jan/Downloads/redis-6.0.10/tests/tls/redis.key',
				'cafile' => '/home/jan/Downloads/redis-6.0.10/tests/tls/ca.crt',
				'verify_peer_name' => false
			]

Could you explain, why this is the case ?
Thank you in advance

[willbrowningme]

@janackermann same thing here. Connecting to a cluster only works if you remove the 'stream' key. Took me quite some time to figure that out! Also has issues with connections freezing using PHP 7.4.3 and TLSv1.3, so had to limit to TLSv1.2 only to get it to work.