Valkey TLS Handshake Error

Products

• VMware Tanzu for Valkey

Issue/Introduction

When TLS is enabled in Valkey, clients may fail to connect to instances with the following error:

# Error accepting a client connection: error:0A0000C7:SSL routines::peer did not return a certificate (addr=#### laddr=####:6379)
# Error accepting a client connection: Connection reset by peer

Environment

• VMware Tanzu Valkey 9.0.0+

Cause

When TLS is enabled in Valkey the setting, tls-auth-clients, defaults to yes which requires that any connecting client provide a valid certificate.

tls-auth-clients provides the following options:

Value	Behavior
yes	(Default) The server requires clients to authenticate with a valid certificate. Connections from clients without a certificate are rejected.
no	The server does not require a client certificate. TLS is still used for encryption, but only the server is authenticated.
optional	The server accepts certificates from clients that provide them but allows connections from clients that do not.

Resolution

Modify the client authentication setting to match your security requirements:

• Access the valkey.conf configuration file.
• Set tls-auth-clients to yes, no, or optional (yes recommended in production environments).
• Restart Valkey service to push the configuration change.
• Monitor client connections.