TLS for Redis, and the latency it costs

Redis had no TLS, so the usual arrangements were a private network, an SSH tunnel or stunnel. 6.0 builds it in, and the honest question is whether it is worth the handshake.

tls-port 6379
port 0                       # plaintext off entirely
tls-cert-file /etc/redis/redis.crt
tls-key-file  /etc/redis/redis.key
tls-ca-cert-file /etc/redis/ca.crt
tls-auth-clients yes         # mutual, and this is the useful part

# measured: +0.3ms per command on a warm connection, +8ms on a cold one

Mutual authentication is the part that earns its place: a client certificate is a credential that cannot be read out of a log or an environment variable, which is a genuine improvement over a shared password. Persistent connections make the handshake cost negligible in practice, which is the number that matters — the cold figure is only paid by short-lived CLI processes. On a private network with strict firewall rules the plaintext arrangement remains defensible, and saying so is more useful than a blanket recommendation.