Redis 7.0 mTLS doesn't work when tls-ca-cert-dir is used

[haikunren]

Here is the redis configuration settings. If tls-ca-cert-file is specified, it works fine. But mTLS fails when tls-ca-cert-dir is set.

tls-cert-file /opt/redis/certs/redis.crt
tls-key-file /opt/redis/certs/redis.key
tls-ca-cert-dir /etc/pki/tls/certs

tls-replication yes

tls-auth-clients optional

port 0
tls-port 6379

bash-4.2$ redis-server my-redis.conf
29274:C 10 Jan 2024 22:56:35.435 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
29274:C 10 Jan 2024 22:56:35.435 # Redis version=7.0.5, bits=64, commit=00000000, modified=0, pid=29274, just started
29274:C 10 Jan 2024 22:56:35.436 # Configuration loaded
29274:M 10 Jan 2024 22:56:35.437 * monotonic clock: POSIX clock_gettime

29274:M 10 Jan 2024 22:57:27.687 # Error accepting a client connection: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
29274:M 10 Jan 2024 22:57:27.692 # Error accepting a client connection: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed

[sundb]

@haikunren Did you run c_rehash in the dir of the ca cert file first?

[haikunren]

@sundb, No, I didn't. I will test it. Thanks.

[haikunren]

@sundb, that did the trick after I run c_rehash the ca cert files. One quick question, will Redis need to restart if new ca certs are added into "tls-ca-cert-dir" dynamically? Thanks.

[sundb]

@haikunren doesn't need to restart.

[haikunren]

Thank you!