azure - 使用 RDM 使用 SSL 通过 Ngnix 安全连接到 Redis 容器

Question

我无法使用 Redis 桌面管理器 (RDM) 通过安全连接(基于 SSL)连接到 Redis 容器。所以，我一起部署了两个容器:

1. Redis 容器暴露端口 6379
2. Nginx 镜像，它接受来自 redis 客户端的 SSL 请求，并通过本地主机连接将 tcp 请求传递给另一个 redis 容器。

遵循本教程:https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-group-ssl

并使用生成的自签名证书 SSL。

这是 Nginx.conf 文件:

user nginx;

worker_processes auto;

events {
  worker_connections 1024;
}

pid        /var/run/nginx.pid;

stream  {
    server {
        listen [::]:443 ssl;
        listen 443 ssl;
        proxy_pass 127.0.0.1:6379;

        ssl_protocols              TLSv1 TLSv1.1 TLSv1.2;

        ssl_ciphers                ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK;
        ssl_prefer_server_ciphers  on;

        ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
        ssl_session_timeout  24h;

        ssl_certificate      /etc/nginx/ssl.crt;
        ssl_certificate_key  /etc/nginx/ssl.key;
    }
}

容器部署Yaml文件如下:

api-version: 2018-10-01
location: eastus
name: rediscontainer-int
properties:
  containers:
  - name: nginx-with-ssl
    properties:
      image: nginx
      ports:
      - port: 443
        protocol: TCP
      resources:
        requests:
          cpu: 2
          memoryInGB: 3
      volumeMounts:
      - name: nginx-config
        mountPath: /etc/nginx
  - name: my-app
    properties:
      image: redislabs/rebloom:latest
      ports:
      - port: 6379
        protocol: TCP
      resources:
        requests:
          cpu: 2
          memoryInGB: 3
  volumes:
  - secret:
      ssl.crt: <Enter contents of base64-ssl.crt here>
      ssl.key: <Enter contents of base64-ssl.key here>
      nginx.conf: <Enter contents of base64-nginx.conf here>
    name: nginx-config
  ipAddress:
    ports:
    - port: 443
      protocol: TCP
    type: Public
    dnsNameLabel: rediscontainer-int
  osType: Linux
tags: null
type: Microsoft.ContainerInstance/containerGroups

通过指定容器公网IP的RDM连接，如下:

指定 SSL:

Answer 1

关键是您使用的是自签名证书，默认情况下系统不信任该证书。因此，您需要将其添加到受信任的证书存储区。

以下是我的成功经验:

请确认您已为证书设置正确的 CN。

然后为其添加 DNS 记录:(为了测试，您可以修改您的主机文件以将主机名映射到您的容器 IP)

重要!然后将您的自签名证书添加到受信任的存储区:

然后，您需要通过主机名连接到您的 redis:

如果一切正常，那么你就可以安全地连接到Redis了: