apache / apache/apisix

bug: Redis TLS connections should set SNI (server_name) to redis_host when redis_ssl is enabled

Closed
#13,926 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Current Behavior

When policy: "redis" and redis_ssl: true are configured:

1. APISIX connects with TLS but does not set server_name (SNI) in sock_opts.
2. Against Redis backends that require SNI (common on port 443), the connection returns non-Redis data (often HTTP).
3. lua-resty-redis fails parsing the reply with:
4. failed to limit count: unknown prefix: "72" (72 = ASCII 'H', i.e. an HTTP response like HTTP/1.1 ...)
5. With allow_degradation: false, the route returns 500.

server_name is never set, even though lua-resty-redis connect() supports it.

### Expected Behavior

When redis_ssl: true and redis_host are set, APISIX should set SNI on the TLS handshake, e.g.:

if conf.redis_ssl and conf.redis_host then
sock_opts.server_name = conf.redis_server_name or conf.redis_host
end

This should match redis-cli --tls --sni behavior.
Optionally, add redis_server_name to [apisix/utils/redis-schema.lua](https://github.com/apache/apisix/blob/release/3.13/apisix/utils/redis-schema.lua) when SNI must differ from redis_host.
Lua Resty source: https://github.com/openresty/lua-resty-redis/blob/v0.29/lib/resty/redis.lua#L166

### Error Logs

2026/09/08 18:04:40 [error] 51#51: *385221035 [lua] init.lua:317: phase_func(): failed to limit count: unknown prefix: "72", client: 10.23.131.147, server: _, request: "GET /health/ready HTTP/1.1", host: "test-redis.net"

### Steps to Reproduce

rerequisites
Redis endpoint that requires TLS + SNI on port 443

redis-cli with TLS for comparison.
1. Verify Redis works with SNI (baseline)
redis-cli -h -p 443 --tls \
--sni \
--user default \
-a '' PING
Expected: PONG

2. Configure limit-count with Redis policy (no SNI in APISIX)
{
"limit-count": {
"count": 60,
"time_window": 60,
"policy": "redis",
"key": "remote_addr",
"key_type": "var",
"rejected_code": 429,
"redis_host": "",
"redis_port": 443,
"redis_ssl": true,
"redis_ssl_verify": false,
"redis_username": "default",
"redis_password": "",
"allow_degradation": false
}
}

3. Send traffic to the route
curl -i https:///

4. Check APISIX error log
failed to limit count: unknown prefix: "72"

5. Compare without SNI (optional)
redis-cli -h -p 443 --tls -a '' PING

### Environment

- APISIX version (run `apisix version`): 3.18.0
- Operating system (run `uname -a`): Linux (Debian-based container / AKS node)
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
N/A
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
N/A
- APISIX Dashboard version, if relevant:
N/A
- Plugin runner version, for issues related to plugin runners:
N/A
- LuaRocks version, for installation issues (run `luarocks --version`):
N/A (using official APISIX image)

Contributor guide

Open the contributing guide

Research direction

Start with apisix/utils/redis-schema.lua and the Redis connection path used by the limit-count plugin; compare its sock_opts with lua-resty-redis connect() at the linked source. Done when redis_ssl connections send redis_host, or redis_server_name when configured, as SNI and the reproduction no longer returns the unknown-prefix error.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, redis
Domain
backend, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.