bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled
- Dominant language
- Lua
- Stars
- 17.1k
- Forks
- 2.9k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 63
Description
### Current Behavior
When policy: "redis" and redis_ssl: true are configured:
1. APISIX connects with TLS but does not set server_name (SNI) in sock_opts.
2. Against Redis backends that require SNI (common on port 443), the connection returns non-Redis data (often HTTP).
3. lua-resty-redis fails parsing the reply with:
4. failed to limit count: unknown prefix: "72" (72 = ASCII 'H', i.e. an HTTP response like HTTP/1.1 ...)
5. With allow_degradation: false, the route returns 500.
server_name is never set, even though lua-resty-redis connect() supports it.
### Expected Behavior
When redis_ssl: true and redis_host are set, APISIX should set SNI on the TLS handshake, e.g.:
if conf.redis_ssl and conf.redis_host then
sock_opts.server_name = conf.redis_server_name or conf.redis_host
end
This should match redis-cli --tls --sni behavior.
Optionally, add redis_server_name to [apisix/utils/redis-schema.lua](https://github.com/apache/apisix/blob/release/3.13/apisix/utils/redis-schema.lua) when SNI must differ from redis_host.
Lua Resty source: https://github.com/openresty/lua-resty-redis/blob/v0.29/lib/resty/redis.lua#L166
### Error Logs
2026/09/08 18:04:40 [error] 51#51: *385221035 [lua] init.lua:317: phase_func(): failed to limit count: unknown prefix: "72", client: 10.23.131.147, server: _, request: "GET /health/ready HTTP/1.1", host: "test-redis.net"
### Steps to Reproduce
rerequisites
Redis endpoint that requires TLS + SNI on port 443
redis-cli with TLS for comparison.
1. Verify Redis works with SNI (baseline)
redis-cli -h -p 443 --tls \
--sni \
--user default \
-a '' PING
Expected: PONG
2. Configure limit-count with Redis policy (no SNI in APISIX)
{
"limit-count": {
"count": 60,
"time_window": 60,
"policy": "redis",
"key": "remote_addr",
"key_type": "var",
"rejected_code": 429,
"redis_host": "",
"redis_port": 443,
"redis_ssl": true,
"redis_ssl_verify": false,
"redis_username": "default",
"redis_password": "",
"allow_degradation": false
}
}
3. Send traffic to the route
curl -i https:///
4. Check APISIX error log
failed to limit count: unknown prefix: "72"
5. Compare without SNI (optional)
redis-cli -h -p 443 --tls -a '' PING
### Environment
- APISIX version (run `apisix version`): 3.18.0
- Operating system (run `uname -a`): Linux (Debian-based container / AKS node)
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
N/A
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
N/A
- APISIX Dashboard version, if relevant:
N/A
- Plugin runner version, for issues related to plugin runners:
N/A
- LuaRocks version, for installation issues (run `luarocks --version`):
N/A (using official APISIX image)
Contributor guide
Research direction
Start with apisix/utils/redis-schema.lua and the Redis connection path used by the limit-count plugin; compare its sock_opts with lua-resty-redis connect() at the linked source. Done when redis_ssl connections send redis_host, or redis_server_name when configured, as SNI and the reproduction no longer returns the unknown-prefix error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, redis
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100