Secure your data by using a per-instance Certificate Authority (CA)

You can encrypt all data that moves between your client applications and Memorystore for Valkey securely. This is in-transit encryption. By using in-transit encryption, all Valkey traffic is encrypted through the Transport Layer Security (TLS) protocol. This ensures that all data that moves between your applications and Memorystore for Valkey remains confidential and untampered.

When in-transit encryption is enabled, Valkey clients communicate exclusively across a secure connection. Valkey clients that aren't configured for TLS are blocked. If you choose to use in-transit encryption, then you're responsible for ensuring that your Valkey client can use the TLS protocol.

Instances that use in-transit encryption have Certificate Authorities (CAs). You use the CAs to authenticate the certificates of the machines in your instances.

One CA mode that you can use is a per-instance CA. Memorystore for Valkey provisions each instance with its own, unique CA infrastructure. To access an instance securely, you must configure your client application to trust this CA hierarchy. This involves downloading and installing CA certificates on each client that accesses the instance.

Create an instance that uses a per-instance CA

Console

Follow the steps at Create instances.

gcloud

To create an instance that uses a per-instance CA, use the gcloud memorystore instances create command.

gcloud memorystore instances create INSTANCE_ID \
--location=REGION_ID \
--endpoints='[{"connections": [{"pscAutoConnection": {"network": "projects/PROJECT_ID/global/networks/NETWORK_ID", "projectId": "PROJECT_ID"}}]}]' \
--replica-count=REPLICA_COUNT \
--node-type=NODE_TYPE \
--shard-count=SHARD_COUNT \
--engine-version=ENGINE_VERSION \
--mode=MODE \
--transit-encryption-mode=server-authentication \
--server-ca-mode=google-managed-per-instance-ca

Make the following replacements:

INSTANCE_ID: the ID of the instance that you're creating. The instance ID must be 1 to 63 characters, and use only lowercase letters, numbers, or hyphens. It must start with a lowercase letter, and end with a lowercase letter or number.
REGION_ID: the region where you want the instance to be located.
PROJECT_ID: the ID of the project where you want to create the instance.
NETWORK_ID: the ID of the network that you want to use to create the instance.
REPLICA_COUNT: the number of replicas (per shard). Accepted values are 0-5.
NODE_TYPE: the node type. Accepted values are:
- shared-core-nano
- standard-small
- highmem-medium
- highmem-xlarge
Caution: We recommend that you use the shared-core-nano node type for development or testing purposes only because this node type has no SLA. If you run Memorystore for Valkey in a production environment, then we recommend using the standard-small, highmem-medium, or highmem-xlarge node types. For more information about these node types, see Choose a node type.
SHARD_COUNT: the number of shards in the instance. The shard count determines the total memory capacity for storing instance data. For more information about instance specifications, see Instance and node specification.
ENGINE_VERSION: the version of the instance. Accepted values for this parameter are VALKEY_7_2, VALKEY_8_0, and VALKEY_9_0. If you don't specify a value, then VALKEY_9_0 is the default value.

Important: If you specify VALKEY_9_0 as the version of the instance, then you can't downgrade the instance to an earlier version.
MODE: determine if the instance is Cluster Mode Enabled or Cluster Mode Disabled. If this field is omitted, then the instance defaults to Cluster Mode Enabled. For more information, see Enable and disable cluster mode.

The server-ca-mode parameter represents the CA mode for the instance. For a per-instance CA, google-managed-per-instance-ca is the value for the parameter. If you don't use this parameter, then the default CA mode is per-instance.

For example:

gcloud memorystore instances create my-instance \
--location=us-central1 \
--endpoints='[{"connections": [{"pscAutoConnection": {"network": "projects/my-project/global/networks/my-network", "projectId": "my-project"}}]}] \
--replica-count=1 \
--node-type=highmem-medium \
--shard-count=3 \
--engine-version=VALKEY_9_0 \
--mode=CLUSTER \
--transit-encryption-mode=server-authentication \
--server-ca-mode=google-managed-per-instance-ca

Download the CAs

If you enable in-transit encryption for an instance, then when you use the get-certificate-authority command, the certificates of the CAs appear.

gcloud memorystore instances get-certificate-authority INSTANCE_ID

Replace INSTANCE_ID with the ID of the instance.

The response body includes certificates for all applicable CAs.

Install CA certificates on the client

You must install the CA certificates on the client that connects to the instance. Depending on the type of client, the CA certificate installation might vary.

To install a CA certificate on a Compute Engine Linux VM, do the following:

Use SSH to connect to a Compute Engine Linux client.
In the client, use the following command to create a server_ca.pem file:
```
sudo vim /tmp/server_ca.pem
```

Download the CAs and paste them into the server_ca.pem file.

You must format the text of the CAs correctly. The server_ca.pem file might appear, as follows:

To format the text in the file correctly, use the following guidelines:

Copy the entire CA, including the -----BEGIN CERTIFICATE----- and
-----END CERTIFICATE----- lines.
Make sure that the text of the CAs is completely left justified. Verify that no spaces appear in front of any line of the CAs.
Add each CA on a new line. Verify that no blank lines exist between CAs.

Configure the client for in-transit encryption

The client that you use to connect to the instance must either support TLS or use a third-party sidecar to enable TLS.

If your client supports TLS, then configure it to point to the instance's IP address, port 6379, and the file containing the CA. You can see examples of how to connect to a Cluster Mode Enabled or Cluster Mode Disabled instance in Memorystore for Valkey that has in-transit encryption enabled.

Manage the CA rotation

We recommend that you install all downloadable CA certificates on the clients that access the instance.

Installing the latest CA certificates periodically ensures that you have the necessary certificates when Memorystore for Valkey rotates the CAs. During this rotation, both the existing CAs and new CAs are active.

Code sample to connect to an instance that uses in-transit encryption

To view a code sample on how to set up a client library to connect to an instance that uses in-transit encryption, see Code sample for both IAM authentication and in-transit encryption.