pkg/storage/redis: add redis TLS support (#1163)

Fixes #1156

pkg/storage/redis/option.go

@@ -0,0 +1,13 @@
+package redis
+
+import "crypto/tls"
+
+// Option customizes a DB.
+type Option func(*DB)
+
+// WithTLSConfig sets the tls.Config which DB uses.
+func WithTLSConfig(tlsConfig *tls.Config) Option {
+	return func(db *DB) {
+		db.tlsConfig = tlsConfig
+	}
+}

pkg/storage/redis/redis.go

@@ -3,9 +3,11 @@ package redis
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/golang/protobuf/proto"
@@ -35,38 +37,44 @@ type DB struct {
 	lastVersionKey         string
 	versionSet             string
 	deletedSet             string
+	tlsConfig              *tls.Config
 }
 
 // New returns new DB instance.
-func New(rawURL, recordType string, deletePermanentAfter int64) (*DB, error) {
+func New(rawURL, recordType string, deletePermanentAfter int64, opts ...Option) (*DB, error) {
 	db := &DB{
-		pool: &redis.Pool{
-			Wait: true,
-			Dial: func() (redis.Conn, error) {
-				c, err := redis.DialURL(rawURL)
-				if err != nil {
-					return nil, fmt.Errorf(`redis.DialURL(): %w`, err)
-				}
-				return c, nil
-			},
-			TestOnBorrow: func(c redis.Conn, t time.Time) error {
-				if time.Since(t) < time.Minute {
-					return nil
-				}
-				_, err := c.Do("PING")
-				if err != nil {
-					return fmt.Errorf(`c.Do("PING"): %w`, err)
-				}
-				return nil
-			},
-		},
 		deletePermanentlyAfter: deletePermanentAfter,
 		recordType:             recordType,
 		versionSet:             recordType + "_version_set",
 		deletedSet:             recordType + "_deleted_set",
 		lastVersionKey:         recordType + "_last_version",
 	}
+
 	metrics.AddRedisMetrics(db.pool.Stats)
+	for _, o := range opts {
+		o(db)
+	}
+	db.pool = &redis.Pool{
+		Wait: true,
+		Dial: func() (redis.Conn, error) {
+			c, err := redis.DialURL(rawURL, redis.DialTLSConfig(db.tlsConfig))
+			if err != nil {
+				return nil, fmt.Errorf(`redis.DialURL(): %w`, err)
+			}
+			return c, nil
+		},
+		TestOnBorrow: func(c redis.Conn, t time.Time) error {
+			if time.Since(t) < time.Minute {
+				return nil
+			}
+			_, err := c.Do("PING")
+			if err != nil {
+				return fmt.Errorf(`c.Do("PING"): %w`, err)
+			}
+			return nil
+		},
+	}
+
 	return db, nil
 }
 
@@ -255,6 +263,9 @@ func (db *DB) doNotifyLoop(ctx context.Context, ch chan struct{}, psc *redis.Pub
 			if _, ok := v.(net.Error); ok {
 				return
 			}
+			if strings.HasPrefix(v.Error(), "redigo: connection closed") {
+				return
+			}
 		}
 	}
 }

pkg/storage/redis/redis_test.go

@@ -1,20 +1,27 @@
-// +build redis
-
 package redis
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
+	"io/ioutil"
 	"os"
+	"runtime"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/gomodule/redigo/redis"
+	"github.com/ory/dockertest/v3"
+	"github.com/pomerium/pomerium/pkg/cryptutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/anypb"
 )
 
+var db *DB
+
 func cleanup(c redis.Conn, db *DB, t *testing.T) {
 	require.NoError(t, c.Send("MULTI"))
 	require.NoError(t, c.Send("DEL", db.recordType))
@@ -24,24 +31,97 @@ func cleanup(c redis.Conn, db *DB, t *testing.T) {
 	require.NoError(t, err)
 }
 
+func tlsConfig(rawURL string, t *testing.T) *tls.Config {
+	if !strings.HasPrefix(rawURL, "rediss") {
+		return nil
+	}
+	cert, err := cryptutil.CertificateFromFile("./testdata/tls/redis.crt", "./testdata/tls/redis.key")
+	require.NoError(t, err)
+	caCertPool := x509.NewCertPool()
+	caCert, err := ioutil.ReadFile("./testdata/tls/ca.crt")
+	require.NoError(t, err)
+	caCertPool.AppendCertsFromPEM(caCert)
+	tlsConfig := &tls.Config{
+		RootCAs:      caCertPool,
+		Certificates: []tls.Certificate{*cert},
+	}
+	return tlsConfig
+}
+
+func runWithRedisDockerImage(repo, tag string, env []string, withTLS bool, testFunc func(t *testing.T), t *testing.T) {
+	pool, err := dockertest.NewPool("")
+	if err != nil {
+		t.Fatalf("Could not connect to docker: %s", err)
+	}
+	resource, err := pool.Run(repo, tag, env)
+	if err != nil {
+		t.Fatalf("Could not start resource: %s", err)
+	}
+
+	defer func() {
+		if err := pool.Purge(resource); err != nil {
+			t.Fatalf("Could not purge resource: %s", err)
+		}
+	}()
+
+	scheme := "redis"
+	if withTLS {
+		scheme = "rediss"
+	}
+	address := fmt.Sprintf(scheme+"://localhost:%s/0", resource.GetPort("6379/tcp"))
+	if err := pool.Retry(func() error {
+		var err error
+		db, err = New(address, "record_type", int64(time.Hour.Seconds()), WithTLSConfig(tlsConfig(address, t)))
+		if err != nil {
+			return err
+		}
+		_, err = db.pool.Get().Do("PING")
+		return err
+	}); err != nil {
+		t.Fatalf("Could not connect to docker: %s", err)
+	}
+
+	testFunc(t)
+}
+
 func TestDB(t *testing.T) {
+	if os.Getenv("GITHUB_ACTION") != "" && runtime.GOOS == "darwin" {
+		t.Skip("Github action can not run docker on MacOS")
+	}
+	redisTLSEnv := []string{
+		"ALLOW_EMPTY_PASSWORD=yes",
+		"REDIS_TLS_ENABLED=yes",
+		"REDIS_TLS_CERT_FILE=/tls/redis.crt",
+		"REDIS_TLS_KEY_FILE=/tls/redis.key",
+		"REDIS_TLS_CA_FILE=/tls/ca.crt",
+	}
+	tests := []struct {
+		name    string
+		repo    string
+		tag     string
+		env     []string
+		withTLS bool
+	}{
+		{"redis", "redis", "latest", nil, false},
+		{"redis TLS", "gnouc/pomerium-redis-tls", "latest", redisTLSEnv, true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			runWithRedisDockerImage(tc.repo, tc.tag, tc.env, tc.withTLS, testDB, t)
+		})
+	}
+}
+
+func testDB(t *testing.T) {
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	defer cancelFunc()
-	address := "redis://localhost:6379/0"
-	if redisURL := os.Getenv("REDIS_URL"); redisURL != "" {
-		address = redisURL
-	}
-	db, err := New(address, "record_type", int64(time.Hour.Seconds()))
-	require.NoError(t, err)
+
 	ids := []string{"a", "b", "c"}
 	id := ids[0]
 	c := db.pool.Get()
 	defer c.Close()
 
-	cleanup(c, db, t)
-	_, err = c.Do("DEL", db.lastVersionKey)
-	require.NoError(t, err)
-
 	ch := db.Watch(ctx)
 
 	t.Run("get missing record", func(t *testing.T) {
@@ -94,10 +174,9 @@ func TestDB(t *testing.T) {
 	})
 	t.Run("list", func(t *testing.T) {
 		cleanup(c, db, t)
-		ids := make([]string, 0, 10)
+
 		for i := 0; i < 10; i++ {
 			id := fmt.Sprintf("%02d", i)
-			ids = append(ids, id)
 			data := new(anypb.Any)
 			assert.NoError(t, db.Put(ctx, id, data))
 		}

pkg/storage/redis/testdata/Dockerfile

@@ -0,0 +1,3 @@
+FROM bitnami/redis:latest
+
+Add tls /tls

pkg/storage/redis/testdata/tls/ca.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE5jCCAs4CCQCcWg5kDLmBZTANBgkqhkiG9w0BAQsFADA1MRMwEQYDVQQKDApS
+ZWRpcyBUZXN0MR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjAw
+NzMwMDQyMzAxWhcNMzAwNzI4MDQyMzAxWjA1MRMwEQYDVQQKDApSZWRpcyBUZXN0
+MR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQClzNGrTLlQKurX1CDnCTX2mRD6G0QAlXZ8nU3Lphhu
+8SgJd868DWQp+f/c6VoXuhz+rRZoPrSvgtSCqSrtWy5vj5eC8egvYQNZOcH8aj3R
+1vCq7h10nRUqJGG/PhvQoYKFIx0s4kXiiNsdH+cvnfiIkwt6Hw9eY8GjBgB5lQQ+
+P+RKDjV4busREDfYWV3N+YWoNz7KjRrjJO3XTeDFfywfSGWPKUtJAC3bggjOv76F
+td7iK1bFfcxLVkey3ZOCVp74n3p6tnkF6rXoS4Ji4bfmMjIZubtd/jNZiV1vjsWz
+EiUVo229mROzCug9GbXf8SW9en5qwM8nigL5NQQAObrSwbKTtVLgFLjTcELwiz0H
+/3MSFVWBrWZQZHwXabC/YF2LogZ9ZClGhRn6+kG0wpovBCPltmS9MK8g3dx9U5cP
+VTkm4aer8OlP4wggsGz4Yk410YkBkj/4V3Ge22jRxr93k/OWFDkX+pG44UVlCiFQ
+3hy2X80VQrJn59QM7BrRfnC9JYJvlF5ON+iSuTGDv3r3ELwlPPxHZArPp6KLw4Qm
+yt+b2eMzFx/mS9cAEAw1rwwoGtJdnWXn0UX8qFPc9uJhV9f3xv9tvOAJElKXwMq+
+PKDrY4ThwJGVnkV87WUq8vPal4XNXLKApPdHwnR3bSPVKTSUNsHYARmd0thYshBa
+7QIDAQABMA0GCSqGSIb3DQEBCwUAA4ICAQAu6anZk8Ac5B0mvI3HD2MG885z4l3t
+fo9z1VJHthIyFCUcf/zwkdjFED6Gxn4G5QX399cFg+NrNxEC0x3K3Au4yD/uKCxp
+yhuWzYGamkGzQJ6kX1edJ+l8CgstdVUWBVmWOyPKSQKJKUqaK4flhW6vPZNPTErQ
+nUzjEXDzYGy1OVZlPWh2e5ng9EeTYBkaXMRIL6JbPbNxroE+aQsQ8e737tN+Ih8+
+ZHR4B8/lnipnqUaFpnuK4PJZStQW3rLxv+7Xny3nUM6HKB8iz3JgmDDTlCoOtQ1K
+Dl8J3w4/v12zat5VRwyIkpkbmqsczRnryK+U7iQX7rSTCBBsjC6yXyo/yqR7f7qh
+T2MbXotZDZOopJDkJ70a83bQgR2zlU46oPSXmX7Zum+9zSOSzu5YUeqTC4cvPM8V
+vYimiJnAmwhe9HUXfypezh2LLISqTLt9z+6ZImXf+KSu6xdocdON7cMfyxWhVEUw
+twHnNYH88OlacSHLSG5ArnoNGnkELfBB8gVXjaVH4n/q0XJCEFu85WPKfgS0aA6c
+rMKh3Fo3dpkTXg69aCXBKTwnp0+1uV6F7gB0YyOjd1bBhEQjRF6rNmbqX7f0vYNO
+JSLoJWZsLidmBFsAEhLMnyE9tX7nzgLT38gzOhEhjMdZaGHw8lEx+WZnT0F/Sl+o
+izm4jRW7jSLxfw==
+-----END CERTIFICATE-----

pkg/storage/redis/testdata/tls/ca.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEApczRq0y5UCrq19Qg5wk19pkQ+htEAJV2fJ1Ny6YYbvEoCXfO
+vA1kKfn/3OlaF7oc/q0WaD60r4LUgqkq7Vsub4+XgvHoL2EDWTnB/Go90dbwqu4d
+dJ0VKiRhvz4b0KGChSMdLOJF4ojbHR/nL534iJMLeh8PXmPBowYAeZUEPj/kSg41
+eG7rERA32FldzfmFqDc+yo0a4yTt103gxX8sH0hljylLSQAt24IIzr++hbXe4itW
+xX3MS1ZHst2Tglae+J96erZ5Beq16EuCYuG35jIyGbm7Xf4zWYldb47FsxIlFaNt
+vZkTswroPRm13/ElvXp+asDPJ4oC+TUEADm60sGyk7VS4BS403BC8Is9B/9zEhVV
+ga1mUGR8F2mwv2Bdi6IGfWQpRoUZ+vpBtMKaLwQj5bZkvTCvIN3cfVOXD1U5JuGn
+q/DpT+MIILBs+GJONdGJAZI/+Fdxntto0ca/d5PzlhQ5F/qRuOFFZQohUN4ctl/N
+FUKyZ+fUDOwa0X5wvSWCb5ReTjfokrkxg7969xC8JTz8R2QKz6eii8OEJsrfm9nj
+Mxcf5kvXABAMNa8MKBrSXZ1l59FF/KhT3PbiYVfX98b/bbzgCRJSl8DKvjyg62OE
+4cCRlZ5FfO1lKvLz2peFzVyygKT3R8J0d20j1Sk0lDbB2AEZndLYWLIQWu0CAwEA
+AQKCAgEAlh60fSCT7bVeO5tTSz04whXnnD1RviGWTdB0Hv89wj3SHXiAFB8f4S39
+8DzNGQynsiRwVGTqXrvbxI59UrorelGOQr7blwKE8KXuMajUXon6ERpWSz7raePV
+KT6IGsgSEJAxm3EpC6sUkfNP9PpYjPhu/Nzgons6WWxWw78cP2zEPBVPbsMnTaTc
+m6SW3aee0CdtUCKhBKdsPnTCHrA99/kqE4y1INzrqIO9i81rKU/6Bdht0ZVMg64U
+byxWoj3h5IUpdbCANc5FdJXh8bwkMWajnE1iDAHc5qYMlrSz5qZ4M3ZtJ61Re9xV
+WPVNiv2iSUR+8BOxvUAl3xSUkcuzjilDxza3S1Ryglw9/6x8UYYOMA71BGK4FuBc
+ebQNElJTTPRUaGVo0+Wx/+lBW7PL2HCWXTuF61qskIzLi43+eDaVPSbSqw3Kd+GW
+KZQ2dFCMWOjSPFFtm2PtJEy4SQOLFx6lvWslKXYXC9tcMHLM3VMd1+I2WZC3TnnG
+uSeeTXibbRcQadZbIDQ6HdfdHwnDd20bC140CIm3qdFtUtHR/mvC+2JvR48+edT4
+Vpn0VHPDbLB5N4wHDlvwWIjTToJUA5OS1478bycV1S8oDxL9fDrjTdH8DFvd3IN5
+S4YMWSB+5y933gUTquJjA6e1LfOYQ/tvUcL0cRwTWtNCPMEG0ZUCggEBAM8LCvxh
+ZFwB8tDBtR4g4qF8IQKTf5y225P92u2TL2jRm+W7hCgc8x0a7VI7yA+Q8CBT+WuW
+NhKlI/OKgNQhotRTPFyhuhz9NKkT7ZRdv9baOeB+VeXh0gzj2+s81x3xH3ermb86
+UoPgeOZH87GbNRW472a5+U3ks/K+kIcX2kpDzKPBwYp+ZZ7AKprVSvyK8+0Y+o/v
+mFQKdZBR36jIlG2mabx/iSlZxSYOsi89K8R1tqsDcIlAyFIHBZKTuEGkY4fAEfDc
+NZejwpcOmeXsh2P7+T71o6efcYIoeVS0YkeWCBV/vX667F/uEbq0/Wtp/ClRNg21
+0D0RhHj/MMsUKVsCggEBAM0BNPS1v64Kr5FDGXZ4xqfqXGse8EvQTVDnUjaRO6K9
+ZKf2ezNRzxQ5RVJAYLhnqSn1ISDuuaSDR9NP74FptKHemswfNqIH206Z+MweBmEX
+6+wXuYlI+e4tCUgeUlDh3gu4OBsNlWtwU2oD/zE3RB3DO60Nn1yuZxP7OK1wzOLi
+NLvVHdm9x+h5EaQBaaRM3sOGEdndGXFoCXZzfbezf7O2cMW58Gc6HKnIeodgM3UU
+ApaY/odPUYmUaPqdbhBViNBNjYjGhQWsQN5ot6VB5sGFsfJD5eKuVDLeAnKINUaO
+e8T4m7QLCU8pbeVebQoMD47jtBbbgztAnYs7ioCHd1cCggEAIdNJCTCUJ9/9npN3
+FqQCwqU382bLm3vYZdY8dUHtpe9Qy/iVv8PzCBdFHIE9zyU7xdxSTHxu+x7Vv80p
+/P49zviGTQ/zCxdnChSCZRHn7J8cg4vAVt1M5uQ3Irh+4JprLK7xYGeT4Y3D0sOA
+kcysoI7lNeA+VbZ+m7L8g8Wm2Sk4fqyCBTFfQs9cZo1gQeAlt9+z194qAdjvmhN2
+OeoDLeLZNX2UmBfdeLk/7S3OP7uHi2r1cMcPsy8Ifwj5Omg0BpKfm70uWEbd3LX6
++LBq8i/RabLR+Om4rq4UHH2X7OAbFAAZomHBim6noNw+5tSa6Nkmvpism72H6giv
+HQ5/LwKCAQBYZw3T/NAUmC0PghTn3rsjy89gri3HM6MzoRz1xPkne259c6+6+KtI
+uE2pY3OR8bmkCz3m+qr5Q1dky1KnxtKK/vhXz5n6k1LB+Wmtc8Eie3NUEwMCLYMB
+b1BSVij/EfdzrFQdbmUhuIVv8RtJuOBZyUfhnz86c0al+i59tGfV6t/8o7FEpS8g
+k5zE0Yshu7hQLm9iOJLxMYDrIHB1GCWYdLL6wOznRsr3eClGWXi3IxLeqEkSRmUN
+4/7FG8BLsObXlKnU8m6IfLhYcGXJELsWdrW+mAL5Fl3etZfulcgLjgPXc7GJGT1B
+csceIvL4Yy0OXCjbtntHwNxvHxThygjvAoIBAQCoRITYoX6Lql8ozAbG4qnYhutL
+uzTt2WAuaEsCPn5+8qANn9DSLbUvPg4nrwCY44pKB5CW1Pfh3VXvJVKSprpj9AFV
+N896EXnm/Zl+3l88bvAtqVc0zPXeLG3HvVldWVwzTSDVJBEoNYMlqwKu0lIGPArV
+YxM+7Oygg559vRi67CYMK+CLjh4kVJ8Rttf4pOO1EedbChbOAlMQy9hcO29xbFK7
+Xhd1TeubGvUqsqD/HNRt010W0HvLeDtUZ1bxOIE7ZdxsmeF4HUGhWmxbofsAio6C
+HGrF+7zN0Dha4DFF4zVyqjZlNlLBYxbJkThyHNbC1Jr9Mior+K8IN2NrROjJ
+-----END RSA PRIVATE KEY-----

pkg/storage/redis/testdata/tls/ca.txt

@@ -0,0 +1 @@
+D2B95B278BB44405

pkg/storage/redis/testdata/tls/redis.crt

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID2jCCAcICCQDSuVsni7REBTANBgkqhkiG9w0BAQsFADA1MRMwEQYDVQQKDApS
+ZWRpcyBUZXN0MR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjAw
+NzMwMDQyMzQ0WhcNMjEwNzMwMDQyMzQ0WjApMRMwEQYDVQQKDApSZWRpcyBUZXN0
+MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDlqpPoUThTy+bbhKynsb1q/jSkh6UlvaitCgLANlmpQzGMLkK7lRcOF3GA
+VthohYcHEitUzqtgkqYtdruQ38/fWRJZUnfjV8wCp9pVZ8iVnPr6oAXN/u0REeye
+jrwnEzEao1Bn9QpLtHB7o0GsHgEcu1DpZGWxjZY6TNcO1OT61slYvmXM7D0oEPD8
+P05uGgImpmD9gE0pZTMnZKCjdErBE+9AldbHpQEQukQ60DBw4Px8fSWYdXOUbi4H
+12AcNq//LFtpEtsFZ2FtUoRxhwVxeXmoPkYmnz1ZUssWtND/AMYcke3+OJ+hh4tU
+qU28IOj2muCFs9Ibh+ecFwXZFzgrAgMBAAEwDQYJKoZIhvcNAQELBQADggIBAD+J
+/MKK7e8PDSNqZl5vKj4CWZCAiHDFTIuyjGN0SBGlhIAVYEmUU28QHIpB7P/BTbih
+ToUW9Z1AEcbNbo3jRnLftZ5dHT0m7VxmFhTw3S2+D8oFuFOSVGQ49UFFb/Mc6VXT
+AIhgSSfMo0Sl83oyA35U4bKBkyW+3zPm/Tlagqsotxp4IMfDNc1dAMoeVSS8Pb5k
+KZxxGBU7dkxeLVywzTloVXduMuE6eVOZgEOCPCG419RHUFSvZKSxIjatgK+bkw9H
+WYtGduRZinU2QDlnTZVhq78rqhrsloW4uCfpBo/DF5V043iQ5RmGuLzFkilRvpZQ
+QAAbc2qWxUJKl61TprY9RD1vp35TXuTsJIiiGYYOXJjc1lEE7VjRi1JDPPtT2DpW
+GDJE/ma7VwzHUf3+AOrq4TH1Cjw0v0sz2rwkS4KAKTqz/CYoIg1wwUnOOr5FfSSP
+6rzaAhtWK3+jJW6jf1+Loe7FtEeL8uzILbxmHrjoBLvRU8zlLYvXl9TnPDXRE2TF
+4mSySab4OVILxf0ykRdrsO9of10xl3x5MKAbEsHiwsMrA47lN8WxF/BD2OhZMMA7
+HOWoB+O5qrwHSQJiVCRWWw3OpCeguMgrC8u4gWM6i589yH6fpRwH5dxCtIcrJBmB
+YuhPo+21yI3+v6ylQcY2Rrh7k5TlCpCQYFHfcmOV
+-----END CERTIFICATE-----

pkg/storage/redis/testdata/tls/redis.dh

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA0z6Tn69LEeG4+pooHvW9ENMBqdd23JD0UvB69TknOLogvSFUpQwI
+JNlhisC0a4LjuBD07X9drWW1uL2yb8vgexGRpWxLmPMEUTMTCRzkHVQEHSkV6MJn
+todbgVQ4c2DRGAsSA8VY5XVGIf6w7IUJ/OagyQ/Gr/9+DzliOC7svQlR2iKogX/s
+P4+qk0is8lpMMBzhz1bzo4zsJ8NMFqzYGQzuYzlEQlI6UCiiR2+rd6Fh83RbPb12
+4o9XKr0Wh+hAwl6EOERMmHR2UBYFn1+It6vmcg8uJnoEWzSiZTWOXqID3YeRyCPi
+Myz43Ir5tHMz3V6gVSBZnhex09w58FjRkwIBAg==
+-----END DH PARAMETERS-----

pkg/storage/redis/testdata/tls/redis.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEA5aqT6FE4U8vm24Ssp7G9av40pIelJb2orQoCwDZZqUMxjC5C
+u5UXDhdxgFbYaIWHBxIrVM6rYJKmLXa7kN/P31kSWVJ341fMAqfaVWfIlZz6+qAF
+zf7tERHsno68JxMxGqNQZ/UKS7Rwe6NBrB4BHLtQ6WRlsY2WOkzXDtTk+tbJWL5l
+zOw9KBDw/D9ObhoCJqZg/YBNKWUzJ2Sgo3RKwRPvQJXWx6UBELpEOtAwcOD8fH0l
+mHVzlG4uB9dgHDav/yxbaRLbBWdhbVKEcYcFcXl5qD5GJp89WVLLFrTQ/wDGHJHt
+/jifoYeLVKlNvCDo9prghbPSG4fnnBcF2Rc4KwIDAQABAoIBAHWBV9mmLJabHYu1
+Dw1hoBNs6ow/ppxvtCyMkam8ZRV3/pLFXHlTJ4+bKQRL6r9XiiVxA2CJuR9ZCNL8
+C61tBZM1pHC1BAf6dLPrI4dM6VC7F6JBW5bw1mREcncRemzXoekKI+p8cf8X2/E2
+LzSbyV/k6tnu9yTn1zQO+n1pKZq4b/uWu65iMlwRZbOx6vhRRCe+vJSsidAN4O1E
+k6yfJxmVagUNqu4jPmfrcGGbTV27CJgwRZymnnp9pOQ39aJNNmU1EvLdMdFK88hF
+8FRZwE1uYW7sTSXQtoyiaQ/XjaLb2Mu4SqyjkpA7sWqMvQ0tSJOfoRb3kJsUrX4T
+5n4gyXECgYEA9O8MaZ1QynjPJIkm0SC4FkeVbOLwE45+9cGOHsAdigH5Ac/257gx
+tke92Gq06RE3h9NvZ46cTcNB0wavS3BTdgi1Aw6u2JSWsBbndnriUyhoaORosKA/
+j19T+DRjqn7wV8b2coQiW8hUaa1MYazHkO9kyDccacQHhhkRJXnQk+kCgYEA8Arx
+XdVN+vpLAA9EUq71y3Y8EHilK8Yo+5XZT0yAPAi5EZBaZ5dcx+LwCQrIJvDswNpt
+sICwSSJtwGrp9zrdQiTb3NyjU6XFe//pRl3ZVTd6ik64Ol99vBcrAhxMTHbv3xw5
+XY6ToiGTMbsLS28Afigdizpcrz2WScb97pZ7AvMCgYBa7uDx2PjkoqNs0gp6O6Z8
+hwj/yuUMrauO+9QSsIqG8SKMPLRS5Px3yvy9eyg9Gyo9oA7NKJH5ANPQT7wGyuYB
+fUwOnYXmXIvxRh+ayhZ6fxb8UkhXwra2ONMI5BJYexYp0HEwpMPIxYApV7By1t2k
+fmwxNNy0m5WbgHTwL+By+QKBgCJ+0BTV9HDeyyxlBUKElhn5EcSkMchKn9UXwbTd
+n4gBEOdvQS6l19V5zVjfTcga00sbmKvGso6v/emq85htwyIgPeBNbMM2jVy2eAV+
+sx7F7Dw3982br2v6QFn7SxOp++qqGaxSMvEXthltccATYZS/mw9JAczFIvXTPOau
+hVr1AoGAQ/QV3VKabio66A6pzS4JmHU8tAlDuLGbFG1uUYZZoQDz5mwij7WTMy3a
+DQ2TnanrHeyQY9SKK+FLOoezE8IeOyZC/Er3TOoCH5p+OM47mblANtSj3BL7oWif
+KPxtI0OZlmUbQvGTrRdy5093FtRXiLB/rAnJ2cox12mYqwStDbA=
+-----END RSA PRIVATE KEY-----