一、自签 SSL 证书

创建一个空白文件夹 certs 并在这个目录中执行以下命令生成证书文件：

$ openssl genrsa -out ca.key 4096 && \
  openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt -subj "/CN=Redis-CA" && \
  openssl genrsa -out redis.key 4096 && \
  openssl req -new -key redis.key -out redis.csr -subj "/CN=redis" && \
  openssl x509 -req -in redis.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out redis.crt -days 3650 -sha256

二、docker-compose.yaml

services:
  redis-with-ssl:
    container_name: redis-with-ssl
    image: hub.deepin.com/library/redis:7.4.6
    command:
      - 'redis-server'
      - '--requirepass redis-password-xxxxxx'
      - '--port'
      - '0'
      - '--tls-port'
      - '6379'
      - '--tls-cert-file'
      - '/certs/redis.crt'
      - '--tls-key-file'
      - '/certs/redis.key'
      - '--tls-ca-cert-file'
      - '/certs/ca.crt'
      - '--tls-auth-clients'
      - 'yes'
    volumes:
      - './certs/:/certs/:ro'
      - './data/:/data/'
    ports:
      - '6379:6379'
    restart: always

三、常见问题

3.1 提示 /data/redis.key Permission Denied

$ cd ./certs/ && chmod 0444 *