On my Ruby on Rails app, I keep getting the error below for the Heroku Redis Premium 0 add-on:
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain)
Heroku Redis documentation mentions that I need to enable TLS in my Redis client's configuration in order to connect to a Redis 6 database. To achive this, I have read SSL/TLS Support documentation on redis-rb. My understanding from it is; I need to assign ca_file
, cert
and key
for Redis.new#ssl_params
. The question is how to set these for Redis or through Sidekiq on Heroku?
Update 3: Heroku support provided an answer which solved the problem.
Update 2: Created Heroku support ticket and waiting response.
Update 1: Asked on Sidekiq's Github issues and was adviced go write Heroku support. Will update this question, when I do get an answer.
I have verified the app does work when the add-on is either one of the below:
Versions:
Some links that helped me to narrow down the issue:
Use OpenSSL::SSL::VERIFY_NONE
for your Redis client.
# config/initializers/sidekiq.rb
Sidekiq.configure_server do |config|
config.redis = { ssl_params: { verify_mode: OpenSSL::SSL::VERIFY_NONE } }
end
Sidekiq.configure_client do |config|
config.redis = { ssl_params: { verify_mode: OpenSSL::SSL::VERIFY_NONE } }
end
Redis.new(url: 'url', driver: :ruby, ssl_params: { verify_mode: OpenSSL::SSL::VERIFY_NONE })
Redis 6 requires TLS to connect. However, Heroku support explained that they manage requests from the router level to the application level involving Self Signed Certs. Turns out, Heroku terminates SSL at the router level and requests are forwarded from there to the application via HTTP while everything is behind Heroku's Firewall and security measures.
Sources