Closed
Description
Lettuce 6.1.0.RELEASE added support for three SSL/TLS verification modes (SslVerifyMode):
NONE(corresponds withsetVerifyPeer(false))CA(only verifies the CA and cert, without verifying the hostname matches)FULL(corresponds withsetVerifyPeer(true))
The new CA mode is most helpful for cluster mode, where the seed connection is made via hostname (and thus matches hostnames in the certificate), but then cluster node connections are made by IP address (which typically do not appear in SubjectAltNames of the certificate, particularly for redis instances from cloud providers).
Currently, Spring Data Redis only supports setVerifyPeer(boolean). I would like Spring Data Redis to support the three verification modes that Lettuce >= 6.1 now supports.
Metadata
Metadata
Assignees
Labels
Type
Projects
Relationships
Participants
Activity
philsttr commentedon Apr 22, 2024
Also somewhat related, I filed redis/lettuce#2837 to request an enhancement to verification modes to better secure connecting to redis in cluster mode from cloud providers.
AnneMayor commentedon May 28, 2024
I think this is a good issue to approach for me. I am going to open PR within this weekend :)
AnneMayor commentedon Jun 2, 2024
Since I have to do my work as soon as quickly I am going to open this PR until the end of June. Thanks.
baojian123 commentedon Jun 30, 2024
Hi @AnneMayor, I have opened a PR on this issue.
AnneMayor commentedon Jun 30, 2024
Thank, @baojian123 👍
Polishing.
Replace Lettuce's verifyPeer with verifyMode.