You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "raji032 (via GitHub)" <gi...@apache.org> on 2026/09/08 23:55:38 UTC
[I] bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled [apisix]
raji032 opened a new issue, #13926:
URL: https://github.com/apache/apisix/issues/13926
### Current Behavior
When policy: "redis" and redis_ssl: true are configured:
1. APISIX connects with TLS but does not set server_name (SNI) in sock_opts.
2. Against Redis backends that require SNI (common on port 443), the connection returns non-Redis data (often HTTP).
3. lua-resty-redis fails parsing the reply with:
4. failed to limit count: unknown prefix: "72" (72 = ASCII 'H', i.e. an HTTP response like HTTP/1.1 ...)
5. With allow_degradation: false, the route returns 500.
server_name is never set, even though lua-resty-redis connect() supports it.
### Expected Behavior
When redis_ssl: true and redis_host are set, APISIX should set SNI on the TLS handshake, e.g.:
if conf.redis_ssl and conf.redis_host then
sock_opts.server_name = conf.redis_server_name or conf.redis_host
end
This should match redis-cli --tls --sni <host> behavior.
Optionally, add redis_server_name to [apisix/utils/redis-schema.lua](https://github.com/apache/apisix/blob/release/3.13/apisix/utils/redis-schema.lua) when SNI must differ from redis_host.
Lua Resty source: https://github.com/openresty/lua-resty-redis/blob/v0.29/lib/resty/redis.lua#L166
### Error Logs
2026/09/08 18:04:40 [error] 51#51: *385221035 [lua] init.lua:317: phase_func(): failed to limit count: unknown prefix: "72", client: 10.23.131.147, server: _, request: "GET /health/ready HTTP/1.1", host: "test-redis.net"
### Steps to Reproduce
rerequisites
Redis endpoint that requires TLS + SNI on port 443
redis-cli with TLS for comparison.
1. Verify Redis works with SNI (baseline)
redis-cli -h <redis-host> -p 443 --tls \
--sni <redis-host> \
--user default \
-a '<password>' PING
Expected: PONG
2. Configure limit-count with Redis policy (no SNI in APISIX)
{
"limit-count": {
"count": 60,
"time_window": 60,
"policy": "redis",
"key": "remote_addr",
"key_type": "var",
"rejected_code": 429,
"redis_host": "<redis-host>",
"redis_port": 443,
"redis_ssl": true,
"redis_ssl_verify": false,
"redis_username": "default",
"redis_password": "<password>",
"allow_degradation": false
}
}
3. Send traffic to the route
curl -i https://<apisix-route-url>/
4. Check APISIX error log
failed to limit count: unknown prefix: "72"
5. Compare without SNI (optional)
redis-cli -h <redis-host> -p 443 --tls -a '<password>' PING
### Environment
- APISIX version (run `apisix version`):
- Operating system (run `uname -a`):
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`)
- APISIX version (run `apisix version`):
3.18.0
- Operating system (run `uname -a`):
Linux <kernel> (Debian-based container / AKS node)
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
N/A
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
N/A
- APISIX Dashboard version, if relevant:
N/A
- Plugin runner version, for issues related to plugin runners:
N/A
- LuaRocks version, for installation issues (run `luarocks --version`):
N/A (using official APISIX image)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled [apisix]
Posted by "abhinav-phi (via GitHub)" <gi...@apache.org>.
abhinav-phi commented on issue #13926:
URL: https://github.com/apache/apisix/issues/13926#issuecomment-5600684967
Bug is in the redis_ssl path: sock_opts never get server_name set, so the TLS handshake misses SNI. I'll set it when redis_ssl is on (mirroring how the ssl proxy handles upstream SNI) and cover it with a test.
/assign
take
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled [apisix]
Posted by "nic-6443 (via GitHub)" <gi...@apache.org>.
nic-6443 closed issue #13926: bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled
URL: https://github.com/apache/apisix/issues/13926
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled [apisix]
Posted by "meerasridharan-28 (via GitHub)" <gi...@apache.org>.
meerasridharan-28 commented on issue #13926:
URL: https://github.com/apache/apisix/issues/13926#issuecomment-5606790175
@abhinav-phi have you started working on it ? we need similar changes as well
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled [apisix]
Posted by "abhinav-phi (via GitHub)" <gi...@apache.org>.
abhinav-phi commented on issue #13926:
URL: https://github.com/apache/apisix/issues/13926#issuecomment-5607339682
> @abhinav-phi have you started working on it ? we need similar changes as well
Yeah... I have started
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled [apisix]
Posted by "sandeepkunusoth (via GitHub)" <gi...@apache.org>.
sandeepkunusoth commented on issue #13926:
URL: https://github.com/apache/apisix/issues/13926#issuecomment-5607558935
> > [@abhinav-phi](https://github.com/abhinav-phi) have you started working on it ? we need similar changes as well
>
> Yeah... I have started
can you give any ETA when u can open PR. if it takes too long we can open PR. we have tested it already with sni from our side. this is priority for us.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled [apisix]
Posted by "sandeepkunusoth (via GitHub)" <gi...@apache.org>.
sandeepkunusoth commented on issue #13926:
URL: https://github.com/apache/apisix/issues/13926#issuecomment-5593677115
SNI is important here because redis_ssl = true only enables TLS; it does not tell the TLS server which hostname we are trying to reach. For Redis endpoints that use hostname/SNI-based routing, the hostname has to be sent in the TLS ClientHello.
This is also consistent with how common Redis clients handle TLS. For example, go-redis sets tls.Config{ServerName: h} when using a rediss:// URL, so the Redis hostname is used as the TLS server name:
https://github.com/redis/go-redis/blob/master/options.go
redis-py also explicitly added SNI support by passing the Redis host as server_hostname during the TLS handshake:
https://github.com/redis/redis-py/pull/1087
So I think APISIX should similarly set sock_opts.server_name when redis_ssl is enabled, using redis_server_name when provided and otherwise redis_host. This keeps the behavior aligned with common Redis clients and allows APISIX to connect to Redis endpoints that require SNI.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org