To encrypt a Redis connection with stunnel on Ubuntu, run one stunnel instance beside Redis and another beside the client. The server-side instance accepts TLS on a protected port and forwards decrypted traffic to Redis on 127.0.0.1:6379. The client-side instance accepts a local plaintext connection from your application, creates a TLS connection to the remote stunnel listener, and verifies the server certificate. Redis itself remains unaware of TLS.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This design protects the network hop between hosts. You must still bind Redis locally, keep port 6379 off the public network, protect private keys, validate the certificate and hostname, and use Redis authentication or ACLs. If your Redis build supports native TLS, that may be a better fit for replication and cluster-bus traffic.
As an Amazon Associate I earn from qualifying purchases.
How the stunnel and Redis connection is arranged
Stunnel adds TLS to an existing TCP service. It has two opposite operating modes:
- Server mode: accepts an incoming TLS connection, decrypts it, and forwards the resulting Redis protocol to a local Redis process.
- Client mode: accepts a local plaintext connection, opens TLS to a remote stunnel server, and optionally verifies that server against a CA and hostname.
The two Ubuntu hosts therefore use opposite accept and connect settings.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Host | Listener | Outgoing connection | Purpose |
|---|---|---|---|
| Redis host | 0.0.0.0:6380 (restrict this in the firewall) |
127.0.0.1:6379 |
Terminates TLS and passes traffic to local Redis |
| Application host | 127.0.0.1:6380 (or another unused local port) |
redis.example.internal:6380 |
Receives local application traffic and creates TLS |
The sample addresses and ports are examples. Replace them with the real Redis hostname, tunnel port and client network address. Do not let the client-side listener collide with a local Redis service; if Redis already uses local port 6379, use 6380 or another unused port for the application listener.
What you need before installing stunnel
- Two Ubuntu systems, or two Ubuntu environments separated by a network, with administrative access.
- Redis listening on the Redis host. For a stunnel-only design, bind it to loopback rather than a public interface.
- A TCP port for the TLS listener, such as 6380, allowed only from the application host or approved client subnet.
- A server certificate and matching private key. The certificate’s Subject Alternative Name must match the hostname the client uses when it verifies the connection.
- The issuing CA certificate or bundle installed on the client host for trust validation.
- A certificate-management process for renewal and revocation. Do not copy the Redis server’s private key to client hosts.
Redis authentication remains necessary. The Redis AUTH command is itself ordinary Redis traffic; without encryption, an observer could capture credentials. Stunnel protects the inter-host hop, but traffic between an application and its local stunnel process, and between the server-side stunnel and local Redis, can still be plaintext on a compromised host.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install and enable stunnel4 on Ubuntu
Run these commands on both the Redis host and the application host:
sudo apt update
sudo apt install stunnel4
stunnel -version
stunnel -optionsThe package and service layout varies by Ubuntu release. Check the output of the version and options commands, and inspect the installed service unit before relying on a directive in production. Ubuntu packages commonly use /etc/stunnel/ for configuration and a service named stunnel4.
Enable the package’s service at boot. On releases that use the enable flag in /etc/default/stunnel4, edit that file and set:
ENABLED=1Then enable and start the service:
sudo systemctl enable stunnel4
sudo systemctl start stunnel4
sudo systemctl status stunnel4If your package’s unit uses a different configuration directory or startup mechanism, follow the unit shown by systemctl cat stunnel4 and place the configuration where that unit reads it.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPrepare certificates and permissions
Server certificate and key
The Redis host needs a PEM file containing the server certificate and its private key, or separate files if your stunnel build supports separate certificate and key directives. A combined file is common in stunnel examples:
/etc/stunnel/redis-server.pemInstall the certificate chain required by your clients and set restrictive ownership and permissions. The stunnel service account must be able to read the key, while ordinary users must not:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo chown root:stunnel4 /etc/stunnel/redis-server.pem
sudo chmod 640 /etc/stunnel/redis-server.pemIf your service runs under a different account, use that account instead. Never make a private key world-readable. Keep the server key only on the Redis host unless you are deliberately deploying a separate key for mutual TLS.
CA trust on the client
Copy only the CA certificate or CA bundle needed to validate the Redis host certificate to the application host. For example:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →/etc/stunnel/redis-ca.pemsudo chown root:root /etc/stunnel/redis-ca.pem
sudo chmod 644 /etc/stunnel/redis-ca.pemUse a CA file that contains the issuing chain. If the certificate is issued by a private CA, distribute that CA through your normal trust-management process rather than disabling verification.
Optional mutual TLS
One-way TLS authenticates the server to the client. If policy requires client certificates, issue a client certificate and key, configure the client stunnel with its certificate, and configure the server to require and verify peer certificates. The exact verification directives are release-sensitive; confirm the accepted names and syntax with the Ubuntu stunnel manpage and stunnel -options. Mutual TLS does not replace Redis ACLs.
Configure the Redis host as a stunnel TLS server
Create a service configuration such as /etc/stunnel/redis-server.conf. This example terminates TLS on port 6380 and forwards the decrypted stream to Redis on loopback:
pid = /run/stunnel4/redis-server.pid
setuid = stunnel4
setgid = stunnel4
cert = /etc/stunnel/redis-server.pem
; Optional socket tuning; remove if unsupported by your package
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
[redis-tls]
accept = 0.0.0.0:6380
connect = 127.0.0.1:6379Use a specific server interface address instead of 0.0.0.0 when you can. If the service must listen on all interfaces, enforce the source restriction in the firewall. The connect line is deliberately loopback: exposing Redis itself on a second network interface would bypass the tunnel.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →For a client-certificate deployment, add the CA and peer-verification settings required by your installed stunnel version. Do not copy a sample verbatim when its certificate paths, verification mode or directive names do not match your package.
Configure the application host as a stunnel TLS client
Create /etc/stunnel/redis-client.conf on the application host:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
client = yes
CAfile = /etc/stunnel/redis-ca.pem
verifyChain = yes
checkHost = redis.example.internal
[redis]
accept = 127.0.0.1:6380
connect = redis.example.internal:6380Replace redis.example.internal with the DNS name that appears in the server certificate. If your certificate is issued for a different name, either use that name in connect and DNS or obtain a certificate with the correct Subject Alternative Name. Do not solve a name mismatch by turning verification off.
Point the application at 127.0.0.1:6380. The application-to-stunnel segment is local plaintext, which is normally acceptable when the application host is trusted and access to the loopback listener is controlled. If an application requires port 6379 and no local Redis process uses it, change the accept value to 127.0.0.1:6379; otherwise choose an unused local port.
Recommended Free Tools
Harden Redis and the network path
Bind Redis to loopback
In redis.conf, bind Redis to loopback addresses unless another trusted local interface is required:
bind 127.0.0.1 ::1
protected-mode yes
port 6379Restart or reload Redis according to your Ubuntu package’s service procedure, then confirm that it is not listening on a public address:
sudo ss -ltnp | grep 6379If you are using Redis native TLS instead of stunnel, Redis documents a separate tls-port and setting the normal port to 0. Do not apply that native-TLS setting to a plain Redis endpoint that stunnel is expected to reach.
Restrict the tunnel listener
Allow the TLS listener only from the application host or approved network. With UFW, a typical rule is:
sudo ufw allow from CLIENT_IP to any port 6380 proto tcp
sudo ufw deny 6380/tcpReplace CLIENT_IP and the port with your deployment values, and review existing rules before applying a deny rule. Port 6379 should not be allowed from the remote network. A firewall is a second control; loopback binding is still required.
Keep Redis authentication enabled
Use Redis ACL users or a password appropriate to your Redis version and policy. Supply credentials through the application’s secret mechanism. For a command-line check, REDISCLI_AUTH avoids putting the password directly in the command arguments:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
REDISCLI_AUTH='replace-with-a-secret' redis-cli -h 127.0.0.1 -p 6380 PINGDo not paste real credentials into shared shell history, ticket systems or configuration examples.
Start, reload and inspect the tunnel
After creating each configuration, restart or reload stunnel:
sudo systemctl restart stunnel4
sudo systemctl status stunnel4
sudo journalctl -u stunnel4 --no-pager -n 100Some Ubuntu packages load every *.conf file in /etc/stunnel/; others use a unit-specific path. If stunnel starts without your service, inspect the unit and logs for the configuration file it read.
For certificate renewal, install the replacement certificate and key with the same restrictive permissions, validate the file and chain, then reload or restart stunnel during a controlled window. Existing TCP sessions may need to reconnect. Confirm the new certificate from the client before removing the old material.
Verify encryption, identity and Redis access
Check listeners and routes
On the Redis host, verify that Redis is loopback-only and that stunnel owns the external listener:
sudo ss -ltnp | egrep '(:6379|:6380)'From an untrusted remote host, a connection attempt to port 6379 should fail or be unreachable. The same host should be able to reach 6380 only when its firewall policy allows it.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCheck the server certificate
From the application host, inspect the TLS handshake:
openssl s_client -connect redis.example.internal:6380 -servername redis.example.internal -CAfile /etc/stunnel/redis-ca.pemLook for a successful certificate chain and a hostname that matches the value used by checkHost. A successful TCP connection alone does not prove that the intended server was authenticated. Exit the OpenSSL session with QUIT.
Check the Redis protocol through the local listener
Use the client-side local endpoint, not the remote tunnel port, for a Redis test:
REDISCLI_AUTH='replace-with-a-secret' redis-cli -h 127.0.0.1 -p 6380 PINGThe expected response is PONG. This confirms that the application-side stunnel accepted the local connection, established its TLS session, reached the server-side stunnel and delivered a valid Redis command.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Confirm that plaintext is not crossing the network
Capture traffic only on an authorized test system and inspect the remote interface while issuing a command. You should see a TLS handshake and encrypted application records, not readable Redis commands such as AUTH or GET. Do not treat an application successfully connecting to localhost as proof that the network hop is encrypted; inspect the remote listener and certificate validation as separate checks.
TLS settings and Ubuntu version differences
The Ubuntu stunnel manpage documents the client = yes | no mode switch, certificate verification controls, TLS 1.2-and-earlier cipher selection and TLS 1.3 ciphersuite selection. Directive names and available options depend on the installed stunnel build. Before production rollout, record the output of:
stunnel -version
stunnel -optionsSet a minimum TLS version and an approved cipher policy only after confirming that your package supports the directives. TLS 1.2 cipher configuration and TLS 1.3 ciphersuite configuration are separate in stunnel; changing one does not automatically change the other. Prefer the package’s secure defaults when your organization’s policy does not require an explicit list, and remove obsolete protocols rather than adding broad compatibility settings.
Common failures and precise fixes
| Symptom | Likely cause | What to check |
|---|---|---|
| stunnel exits immediately | Invalid directive, missing file or unreadable key | Read journalctl -u stunnel4; verify paths, ownership and the options supported by your build. |
| Connection refused on the local port | Client service is not running, or another process owns the port | Run systemctl status stunnel4 and ss -ltnp; select an unused accept port. |
| Connection refused on the remote port | Server stunnel is stopped, firewall blocks the listener, or DNS points elsewhere | Check the server unit, UFW or upstream rules, DNS resolution and the server’s listening address. |
| Certificate verify failure | Wrong CA file, incomplete chain, expired certificate or hostname mismatch | Run openssl s_client with the same hostname and CA file; correct the chain or certificate SAN. |
| Redis returns an authentication error | The tunnel works but credentials or ACL selection is wrong | Test with the correct Redis user and secret through the local listener; TLS does not bypass Redis authorization. |
| Direct access to port 6379 still works remotely | Redis is bound to a non-loopback address or a firewall rule allows it | Review bind, listening sockets and network ACLs; close the direct path before declaring the migration complete. |
| Only some clients fail after enabling verification | Clients use an IP address or alias absent from the certificate | Use the certificate’s DNS name, add the required SAN in a replacement certificate, or update client configuration. |
Stunnel compared with native Redis TLS
Stunnel is useful when Redis or an existing client cannot speak TLS, but it is a transport wrapper rather than a Redis security feature. Native Redis TLS changes Redis and client configuration directly and can cover traffic that a single stunnel pair does not.
| Decision point | Stunnel | Native Redis TLS | Managed Redis service |
|---|---|---|---|
| Redis support | Works with a plain TCP Redis endpoint and a compatible stunnel package. | Requires a Redis build and configuration with TLS support. | Provider-specific; consult the service’s current TLS settings. |
| Client traffic | Encrypts the path between the two stunnel hosts. | Redis clients connect with TLS directly, such as redis-cli --tls with certificate, key and CA options. |
Usually exposes a provider TLS endpoint; some services can require mutual client authentication. |
| Replication and cluster bus | Not covered automatically by a client/server tunnel; each connection needs its own deliberate design. | Redis documentation covers TLS for clients, replication and the cluster bus. | Provider configures the service’s internal traffic according to its offering. |
| Key management | You manage stunnel files, permissions, renewal and verification on tunnel hosts. | You manage Redis TLS files and client trust, with fewer intermediary processes. | The provider manages host operations; you still manage client trust and credentials. |
| Operations | Adds two services, listeners, firewall rules and another log stream. | Fewer moving parts when your Redis build already supports TLS. | Removes most host-level maintenance but introduces provider controls, availability terms and pricing. |
| Performance | Encryption and proxying add processing and a network hop; no authoritative universal numeric figure applies. | Encryption still has overhead, but avoids a separate proxy process. | Performance and limits depend on the provider’s service tier and configuration. |
Redis documentation also supports redis-cli --tls and native TLS for replication and cluster-bus traffic. If your deployment needs those paths encrypted, native TLS is generally simpler than extending stunnel to every Redis connection. A managed service can be preferable when maintaining Ubuntu tunnel hosts, certificates and firewall rules is not acceptable; verify whether TLS is enabled by default, whether mutual authentication is available and how the provider charges for the service.
When stunnel is the right choice
- Use stunnel when an existing Redis client speaks only plaintext and you need to protect one controlled network hop without replacing Redis.
- Use native Redis TLS when your Redis version and build support it, especially for replication, Sentinel-related connections or cluster-bus coverage.
- Use a managed Redis offering when you want the provider to operate the Redis hosts and document the in-transit encryption model, accepting its pricing and service constraints.
Whichever option you choose, the security test is the same: the intended certificate is validated, direct Redis exposure is closed, Redis authorization remains enabled, and every Redis traffic path that matters to your architecture is included in the encryption design.
Frequently Asked Questions
Can I use port 6379 for both the local application listener and Redis?
Only when no local Redis process already owns that address and port. In most deployments, keep Redis on 127.0.0.1:6379 and assign the client-side stunnel an unused local port such as 6380, then point the application to that port.
Does a successful stunnel connection prove that the correct Redis server was reached?
No. TCP connectivity proves only that a listener answered. Require CA-chain validation and hostname verification, then confirm the certificate with an OpenSSL handshake and test Redis through the local listener.
How do I encrypt Redis replication or cluster-bus traffic with this setup?
A single client/server stunnel pair does not cover those additional Redis connections automatically. Use Redis native TLS, or design and operate separate authenticated tunnels for every required connection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
