When using rediss:/ URLs, auto-configure tls.servername

[paulmelnikow]

As mentioned at #939 (comment), using ioredis (or node-redis) with Compose.io's Let's Encrypt certificates generates an SSL error:

Error: unable to verify the first certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1049:34)
    at TLSSocket.emit (events.js:182:13)
    at TLSSocket.EventEmitter.emit (domain.js:442:20)
    at TLSSocket._finishInit (_tls_wrap.js:631:8) code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'

Disabling strict SSL is a workaround, though the correct solution is to pass the servername option to TLS.connect, which tells the client which TLS certificate to use.

I found the solution in this article: https://www.compose.com/articles/ssl-connections-arrive-for-redis-on-compose/

It doesn't do an awesome job of explaining the cause, though I think the reason is that there are more than one certificates being used on the same IP address.

My code looks like this:

const options =
  this.url && this.url.startsWith('rediss:')
    ? {
        //  https://www.compose.com/articles/ssl-connections-arrive-for-redis-on-compose/
        tls: { servername: new URL(this.url).hostname },
      }
    : undefined
this.redis = new Redis(this.url, options)

I'd be happy to open a PR if this default behavior would be welcome!

[monkbroc]

From the issue comment

Probably this should set tls: true only when tls is not already present in the options.

I submitted PR #939 so I'm happy to submit another PR to correct this issue. In retrospect, I should have added a test to ensure that custom tls options would not be overwritten by the default.

Compose.io's Let's Encrypt certificates generates an SSL error

My use case was Redis through AWS Elasticache. I didn't run into issues with the server name. Thanks for documenting this issue so clearly.

If changing the behavior that rediss:// sets { tls: true } to rediss:// sets the { tls: { servername } works for both AWS and Compose then I agree that making that the default behavior of ioredis would benefit everyone.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 7 days if no further activity occurs, but feel free to re-open a closed issue if needed.