How to Use a Custom CA Certificate for Redis Authentication
book
Article ID: 376419
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How to use a custom CA certificate for Redis Authentication.
Environment
- Carbon Black EDR Server: 7.8.0 and higher
Resolution
- Backup the current Redis certificates.
mkdir /etc/cb/certs/redis_backup && cp /etc/cb/certs/cb-redis* /etc/cb/certs/redis_backup
- Enable the environmental variable that will allow the utility to overwrite the existing CA certificate with the new one.
export FORCE_REGENERATION=redis-ca
- Create the Redis CA using your supplied CA
/usr/share/cb/cbssl certs --regenerate redis-ca --redis-ca-cert-file <user_redis-ca_cert_file> --redis-ca-cert-key <user-redis-ca_cert_key>
- Enable the second environmental variable for the redis cert
export FORCE_REGENERATION=redis
- Create the Redis Certificate
/usr/share/cb/cbssl certs --regenerate redis --redis-cert-file <user_redis_cert_file> --redis-cert-key <user-redis_cert_key>
- Unset the environmental variables
unset FORCE_REGENERATION
Additional Information
- This CA certificate should be specific to the EDR instance and not a shared CA cert with other environments.
- The Redis port 6379 should not be open to the outside internet. This port should only be localhost and for clustered instances open between minions.
Feedback
thumb_up
Yes
thumb_down
No