langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #23624] feat: add Redis SSL/TLS certificate authentication support #30328

New Issue
Closed
opened 2026-02-21 20:47:17 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:47:17 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/23624

State: closed
Merged: Yes

Summary

Changes

New Features

  • Client Certificate Authentication: Support for mutual TLS with client certificates
  • Flexible Certificate Verification: Three modes - CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
  • CA Certificate Validation: Custom CA certificates for validating Redis server certificates
  • Environment Variable Configuration: All SSL options configurable via environment variables

Technical Improvements

  • Fixed SSL constant usage (replaced None with proper ssl.CERT_NONE)
  • Refactored Redis client initialization with cleaner separation of concerns
  • Added dedicated functions for SSL, Sentinel, Cluster, and standalone configurations

Configuration

New environment variables added:

  • REDIS_SSL_CERT_REQS: Certificate verification mode
  • REDIS_SSL_CA_CERTS: Path to CA certificate file
  • REDIS_SSL_CERTFILE: Path to client certificate file
  • REDIS_SSL_KEYFILE: Path to client private key file

Testing

  • Tested with Redis SSL enabled (REDIS_USE_SSL=true)
  • Tested client certificate authentication
  • Tested with different certificate verification modes
  • Verified backward compatibility with non-SSL Redis
  • Tested with Redis Sentinel mode
  • Tested with Redis Cluster mode

Security Considerations

  • Enables compliance with security standards requiring encrypted data in transit
  • Supports zero-trust network architectures with mutual TLS
  • No breaking changes to existing deployments
**Original Pull Request:** https://github.com/langgenius/dify/pull/23624 **State:** closed **Merged:** Yes --- ## Summary - Adds comprehensive SSL/TLS certificate authentication support for Redis connections - Enables secure Redis deployments in high-security enterprise environments - Closes #23623 ## Changes ### New Features - **Client Certificate Authentication**: Support for mutual TLS with client certificates - **Flexible Certificate Verification**: Three modes - CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED - **CA Certificate Validation**: Custom CA certificates for validating Redis server certificates - **Environment Variable Configuration**: All SSL options configurable via environment variables ### Technical Improvements - Fixed SSL constant usage (replaced `None` with proper `ssl.CERT_NONE`) - Refactored Redis client initialization with cleaner separation of concerns - Added dedicated functions for SSL, Sentinel, Cluster, and standalone configurations ### Configuration New environment variables added: - `REDIS_SSL_CERT_REQS`: Certificate verification mode - `REDIS_SSL_CA_CERTS`: Path to CA certificate file - `REDIS_SSL_CERTFILE`: Path to client certificate file - `REDIS_SSL_KEYFILE`: Path to client private key file ## Testing - [ ] Tested with Redis SSL enabled (REDIS_USE_SSL=true) - [ ] Tested client certificate authentication - [ ] Tested with different certificate verification modes - [ ] Verified backward compatibility with non-SSL Redis - [ ] Tested with Redis Sentinel mode - [ ] Tested with Redis Cluster mode ## Security Considerations - Enables compliance with security standards requiring encrypted data in transit - Supports zero-trust network architectures with mutual TLS - No breaking changes to existing deployments
yindo added the pull-request label 2026-02-21 20:47:17 -05:00
yindo closed this issue 2026-02-21 20:47:17 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#30328
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?