Managing Internal Certificate Rotation in Redis Enterprise Software

News Knowledge Base
,
1

How to uninstall mesh_ca Certificate

Overview

Redis Enterprise Software (RS) relies on internally signed certificates for securing communication between cluster nodes. These certificates, including mesh_ca_signed, ccs_internode_encryption, data_internode_encryption, and gossip_ca_signed, are managed by the RS internal Certificate Authority (CA).

This Knowledge Base article explains the expiration and automatic rotation of these certificates, as well as the manual certificate rotation process through the Redis Enterprise REST API.

Certificate Expiry and Automatic Rotation

Expiration Timeline

  • Internal certificates in Redis Enterprise Software expire after 90 days.
  • The certificates are automatically rotated every 30 days.

Alerting on Expiration

  • Redis Enterprise Software monitors the expiration of internal certificates.
  • Alerts are triggered when the expiration date of any internal certificate is less than 45 days away.

Manual Certificate Rotation via REST API

While Redis Enterprise automatically handles certificate rotation, there may be situations where you need to manually rotate the certificates. You can trigger this process using the Redis Enterprise Software REST API.

API Endpoint

To manually rotate the internal certificates, send a POST request to the following API endpoint: POST /v1/cluster/certificates/rotate

Example cURL Command

Here’s an example of how you might make the API request using cURL:

curl -X POST "https://<redis-enterprise-url>/v1/cluster/certificates/rotate" \
-H "Authorization: Bearer <your-access-token>"

Ensure that you replace:

  • <redis-enterprise-url> with the URL of your Redis Enterprise cluster.
  • <your-access-token> with a valid access token for authentication.

Troubleshooting and FAQs

Q1: What happens if the certificates expire before they are rotated?

The cluster will continue to function, but there may be a security risk due to expired certificates. It's important to ensure certificates are rotated before they expire. Alerts will notify you if the expiration is approaching.

Q2: Can I rotate individual certificates, or must I rotate all of them?

The manual rotation process rotates all internal certificates signed by the Redis Enterprise cluster CA. Individual certificate rotation is not supported through the current API.