{"id":33514,"date":"2025-11-03T21:41:25","date_gmt":"2025-11-03T18:41:25","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=33514"},"modified":"2025-11-03T21:41:25","modified_gmt":"2025-11-03T18:41:25","slug":"yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/","title":{"rendered":"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma"},"content":{"rendered":"

<\/p>\n

Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma<\/h2>\n

Bu makalede, y\u00f6netilen bir Redis \u00f6rne\u011fine g\u00fcvenli bir \u015fekilde ba\u011flanman\u0131n yollar\u0131n\u0131, \u00f6zellikle de redis-cli<\/code> gibi TLS deste\u011fi olmayan istemciler i\u00e7in stunnel<\/code> kullanarak nas\u0131l bir TLS t\u00fcneli olu\u015fturulaca\u011f\u0131n\u0131 detayl\u0131 bir \u015fekilde inceleyece\u011fiz. Redis, y\u00fcksek performansl\u0131, bellekte \u00e7al\u0131\u015fan bir veri yap\u0131s\u0131 sunucusu olsa da, varsay\u0131lan olarak a\u011f ileti\u015fimi \u015fifrelenmez. Bu durum, hassas verilerin a\u011f \u00fczerinde a\u00e7\u0131\u011fa \u00e7\u0131kma riskini beraberinde getirir. Y\u00f6netilen Redis hizmetleri (AWS ElastiCache, Azure Cache for Redis, Google Cloud Memorystore vb.) genellikle TLS\/SSL \u015fifrelemesi sunar, ancak bu \u00f6zelli\u011fi kullanmak i\u00e7in istemci taraf\u0131nda da uygun yap\u0131land\u0131rmalar gereklidir. stunnel<\/code>, bu bo\u015flu\u011fu doldurarak eski veya TLS desteklemeyen istemcilerin bile g\u00fcvenli bir ba\u011flant\u0131 kurmas\u0131n\u0131 sa\u011flayan g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r.<\/p>\n

Giri\u015f<\/h3>\n

Redis, modern uygulamalar\u0131n vazge\u00e7ilmez bir par\u00e7as\u0131 haline gelmi\u015ftir. \u00d6nbellekleme, oturum y\u00f6netimi, mesaj kuyruklar\u0131 ve ger\u00e7ek zamanl\u0131 analiz gibi bir\u00e7ok farkl\u0131 kullan\u0131m senaryosunda y\u00fcksek h\u0131z ve esneklik sunar. Ancak, Redis’in temel tasar\u0131m felsefesi basitlik ve performanst\u0131r; bu nedenle varsay\u0131lan kurulumlar\u0131nda a\u011f ileti\u015fimi genellikle \u015fifresizdir. \u00dcretim ortamlar\u0131nda veya hassas verilerle \u00e7al\u0131\u015f\u0131rken, a\u011f trafi\u011finin dinlenmesi (eavesdropping) veya de\u011fi\u015ftirilmesi (tampering) riskini ortadan kald\u0131rmak i\u00e7in ileti\u015fimin \u015fifrelenmesi kritik \u00f6neme sahiptir.<\/p>\n

Y\u00f6netilen Redis hizmetleri, bu g\u00fcvenlik ihtiyac\u0131n\u0131 kar\u015f\u0131lamak \u00fczere TLS\/SSL \u015fifrelemesi sunar. Ancak, redis-cli<\/code> gibi pop\u00fcler komut sat\u0131r\u0131 ara\u00e7lar\u0131 veya baz\u0131 eski istemci k\u00fct\u00fcphaneleri do\u011frudan TLS ba\u011flant\u0131lar\u0131n\u0131 desteklemeyebilir. \u0130\u015fte tam bu noktada stunnel<\/code> devreye girer. stunnel<\/code>, herhangi bir TCP ba\u011flant\u0131s\u0131n\u0131 TLS\/SSL t\u00fcneli \u00fczerinden ge\u00e7irebilen \u00e7ok y\u00f6nl\u00fc bir proxy sunucusudur. Bu sayede, redis-cli<\/code> gibi ara\u00e7lar, yerel bir \u015fifresiz porta ba\u011flan\u0131r gibi g\u00f6r\u00fcnse de, asl\u0131nda stunnel<\/code> arac\u0131l\u0131\u011f\u0131yla uzak Redis sunucusuna g\u00fcvenli, \u015fifreli bir TLS ba\u011flant\u0131s\u0131 kurmu\u015f olurlar.<\/p>\n

Neden Stunnel ve TLS?<\/h3>\n

G\u00fcvenli bir ba\u011flant\u0131 kurmak i\u00e7in stunnel<\/code> ve TLS kullanman\u0131n temel nedenleri \u015funlard\u0131r:<\/p>\n

Veri \u015eifreleme<\/h4>\n

TLS (Transport Layer Security), a\u011f \u00fczerinden iletilen veriyi \u015fifreleyerek, yetkisiz ki\u015filerin bu veriyi okumas\u0131n\u0131 engeller. Bu, \u00f6zellikle internet \u00fczerinden veya g\u00fcvenilmeyen a\u011flar \u00fczerinden hassas verilerin (kullan\u0131c\u0131 bilgileri, API anahtarlar\u0131, finansal veriler vb.) aktar\u0131ld\u0131\u011f\u0131 durumlarda hayati \u00f6neme sahiptir. \u015eifreleme sayesinde, a\u011f trafi\u011fini dinleyen bir sald\u0131rgan bile \u015fifrelenmi\u015f veriyi anlamland\u0131ramaz.<\/p>\n

Man-in-the-Middle (Ortadaki Adam) Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Koruma<\/h4>\n

TLS, sadece veriyi \u015fifrelemekle kalmaz, ayn\u0131 zamanda ba\u011flant\u0131n\u0131n taraflar\u0131n\u0131n kimliklerini do\u011frulamas\u0131na da olanak tan\u0131r. Sunucu sertifikas\u0131 do\u011frulama sayesinde, istemci ger\u00e7ekten ba\u011flanmak istedi\u011fi sunucuya ba\u011fland\u0131\u011f\u0131ndan emin olabilir. Bu, bir sald\u0131rgan\u0131n kendisini araya sokarak hem istemciye hem de sunucuya farkl\u0131 kimliklerde g\u00f6r\u00fcnmesi (Man-in-the-Middle sald\u0131r\u0131s\u0131) ve trafi\u011fi manip\u00fcle etmesi riskini ortadan kald\u0131r\u0131r. stunnel<\/code>, sunucu sertifikas\u0131n\u0131 do\u011frulayarak bu t\u00fcr sald\u0131r\u0131lara kar\u015f\u0131 ek bir koruma katman\u0131 sa\u011flar.<\/p>\n

redis-cli’nin Do\u011frudan TLS Deste\u011fi Eksikli\u011fi<\/h4>\n

redis-cli<\/code>, Redis ile etkile\u015fim kurmak i\u00e7in kullan\u0131lan g\u00fc\u00e7l\u00fc ve basit bir komut sat\u0131r\u0131 arac\u0131d\u0131r. Ancak, Redis 6 \u00f6ncesi s\u00fcr\u00fcmlerde ve baz\u0131 da\u011f\u0131t\u0131mlarda redis-cli<\/code> do\u011frudan TLS ba\u011flant\u0131lar\u0131n\u0131 desteklemez. Y\u00f6netilen Redis hizmetleri genellikle TLS’yi zorunlu k\u0131ld\u0131\u011f\u0131ndan, redis-cli<\/code> gibi ara\u00e7lar\u0131 kullanmak isteyen geli\u015ftiriciler veya sistem y\u00f6neticileri i\u00e7in bu bir engel te\u015fkil eder. stunnel<\/code>, bu durumda bir k\u00f6pr\u00fc g\u00f6revi g\u00f6rerek, redis-cli<\/code>‘nin yerel bir \u015fifresiz ba\u011flant\u0131 \u00fczerinden g\u00fcvenli bir TLS t\u00fcneline eri\u015fmesini sa\u011flar.<\/p>\n

Stunnel’\u0131n Rol\u00fc<\/h4>\n

stunnel<\/code>, bir “TLS\/SSL t\u00fcneli” olu\u015fturarak \u00e7al\u0131\u015f\u0131r. \u0130stemci taraf\u0131nda, stunnel<\/code> belirli bir yerel TCP portunu dinler. redis-cli<\/code> gibi bir istemci bu yerel porta ba\u011fland\u0131\u011f\u0131nda, stunnel<\/code> bu ba\u011flant\u0131y\u0131 yakalar, TLS kullanarak uzak Redis sunucusuna \u015fifreli bir ba\u011flant\u0131 kurar ve iki taraf aras\u0131ndaki trafi\u011fi \u015feffaf bir \u015fekilde t\u00fcneller. B\u00f6ylece, redis-cli<\/code> uzak sunucuya do\u011frudan ba\u011flan\u0131yormu\u015f gibi hisseder, ancak t\u00fcm ileti\u015fim stunnel<\/code> taraf\u0131ndan g\u00fcvenli bir \u015fekilde \u015fifrelenir.<\/p>\n

\u00d6n Ko\u015fullar<\/h3>\n

Bu k\u0131lavuzu takip edebilmek i\u00e7in a\u015fa\u011f\u0131daki \u00f6n ko\u015fullar\u0131n kar\u015f\u0131land\u0131\u011f\u0131ndan emin olun:<\/p>\n

* \u0130\u015fletim Sistemi:<\/strong> Linux (Ubuntu, Debian, CentOS, RHEL vb.) veya macOS. stunnel<\/code> Windows \u00fczerinde de \u00e7al\u0131\u015fabilir, ancak bu k\u0131lavuz daha \u00e7ok sunucu\/geli\u015ftirme ortamlar\u0131na odaklanacakt\u0131r.
\n* redis-cli<\/code> Kurulumu:<\/strong> redis-cli<\/code> arac\u0131n\u0131n sisteminizde y\u00fckl\u00fc ve \u00e7al\u0131\u015f\u0131r durumda olmas\u0131 gerekir. Genellikle Redis sunucusu ile birlikte gelir veya paket y\u00f6neticiniz arac\u0131l\u0131\u011f\u0131yla kurulabilir.
\n* stunnel<\/code> Kurulumu:<\/strong> stunnel<\/code> uygulamas\u0131n\u0131n sisteminizde y\u00fckl\u00fc olmas\u0131 gerekir. Kurulum ad\u0131mlar\u0131 a\u015fa\u011f\u0131da detayland\u0131r\u0131lacakt\u0131r.
\n* Y\u00f6netilen Redis \u00d6rne\u011fi Bilgileri:<\/strong>
\n * Redis Host Adresi:<\/strong> Y\u00f6netilen Redis \u00f6rne\u011finizin u\u00e7 nokta adresi (\u00f6rne\u011fin, my-redis-instance.xxxx.region.cache.amazonaws.com<\/code>).
\n * Redis TLS Portu:<\/strong> Y\u00f6netilen Redis \u00f6rne\u011finizin TLS ba\u011flant\u0131lar\u0131 i\u00e7in kulland\u0131\u011f\u0131 port (genellikle 6379 veya 6380).
\n * Kimlik Do\u011frulama \u015eifresi (iste\u011fe ba\u011fl\u0131):<\/strong> Redis \u00f6rne\u011finiz i\u00e7in bir AUTH<\/code> \u015fifresi belirlenmi\u015fse, bu \u015fifreye ihtiyac\u0131n\u0131z olacakt\u0131r.
\n * TLS Sertifikalar\u0131:<\/strong> Y\u00f6netilen Redis hizmeti taraf\u0131ndan sa\u011flanan CA (Certificate Authority) sertifikas\u0131. Bu genellikle bir .pem<\/code> dosyas\u0131d\u0131r ve sunucu sertifikas\u0131n\u0131 do\u011frulamak i\u00e7in kullan\u0131l\u0131r.<\/p>\n

Stunnel Kurulumu<\/h3>\n

stunnel<\/code> kurulumu, kulland\u0131\u011f\u0131n\u0131z i\u015fletim sistemine g\u00f6re de\u011fi\u015fiklik g\u00f6sterir.<\/p>\n

Linux (Debian\/Ubuntu)<\/h4>\n

Debian veya Ubuntu tabanl\u0131 sistemlerde stunnel<\/code>‘\u0131 a\u015fa\u011f\u0131daki komutla kurabilirsiniz:<\/p>\n

sudo apt update\nsudo apt install stunnel4<\/code><\/pre>\n
Linux (RHEL\/CentOS\/Fedora)<\/h4>\n
RHEL, CentOS veya Fedora tabanl\u0131 sistemlerde stunnel<\/code>‘\u0131 a\u015fa\u011f\u0131daki komutla kurabilirsiniz:<\/p>\n
sudo yum install epel-release # E\u011fer EPEL deposu y\u00fckl\u00fc de\u011filse\nsudo yum install stunnel\n
Veya Fedora i\u00e7in<\/h2>\nsudo dnf install stunnel<\/code><\/pre>\n
macOS<\/h4>\n
macOS \u00fczerinde Homebrew kullan\u0131yorsan\u0131z, stunnel<\/code>‘\u0131 a\u015fa\u011f\u0131daki komutla kurabilirsiniz:<\/p>\n
brew install stunnel<\/code><\/pre>\n
Kurulumdan sonra, stunnel<\/code>‘\u0131n do\u011fru bir \u015fekilde y\u00fcklendi\u011fini do\u011frulamak i\u00e7in s\u00fcr\u00fcm\u00fcn\u00fc kontrol edebilirsiniz:<\/p>\n
stunnel -version<\/code><\/pre>\n
TLS Sertifikalar\u0131n\u0131 Anlama<\/h3>\n
stunnel<\/code>‘\u0131 yap\u0131land\u0131rmadan \u00f6nce, TLS sertifikalar\u0131n\u0131n nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve hangi sertifikalara ihtiyac\u0131m\u0131z oldu\u011funu anlamak \u00f6nemlidir.<\/p>\n
*   Sunucu Sertifikas\u0131:<\/strong> Y\u00f6netilen Redis \u00f6rne\u011finizin kimli\u011fini do\u011frulayan sertifikad\u0131r. Bu sertifika, bir Sertifika Yetkilisi (CA) taraf\u0131ndan imzalanm\u0131\u015ft\u0131r.
\n*   CA (Certificate Authority) Sertifikas\u0131:<\/strong> Sunucu sertifikas\u0131n\u0131 imzalayan g\u00fcvenilir bir \u00fc\u00e7\u00fcnc\u00fc taraf\u0131n (CA) sertifikas\u0131d\u0131r. stunnel<\/code>‘\u0131n sunucu sertifikas\u0131n\u0131n ge\u00e7erlili\u011fini ve g\u00fcvenilirli\u011fini kontrol etmesi i\u00e7in bu CA sertifikas\u0131na ihtiyac\u0131 vard\u0131r. Y\u00f6netilen Redis hizmetleri genellikle bu CA sertifikas\u0131n\u0131 indirmeniz i\u00e7in bir ba\u011flant\u0131 sa\u011flar. \u00d6rne\u011fin, AWS ElastiCache i\u00e7in bu sertifika genellikle rds-combined-ca-bundle.pem<\/code> veya benzer bir isimle bulunur.
\n*   Zincir Sertifikalar (Certificate Chains):<\/strong> Baz\u0131 durumlarda, sunucu sertifikas\u0131 do\u011frudan k\u00f6k CA taraf\u0131ndan de\u011fil, bir ara CA taraf\u0131ndan imzalanm\u0131\u015f olabilir. Bu durumda, k\u00f6k CA’dan sunucu sertifikas\u0131na kadar olan t\u00fcm sertifikalar\u0131 i\u00e7eren bir sertifika zinciri (chain) sa\u011flaman\u0131z gerekebilir. Genellikle, y\u00f6netilen hizmet sa\u011flay\u0131c\u0131lar\u0131 size zaten birle\u015ftirilmi\u015f bir CA paketi sunar.
\n*   PEM Format\u0131:<\/strong> Sertifikalar genellikle PEM (Privacy-Enhanced Mail) format\u0131nda .pem<\/code>, .crt<\/code>, .cer<\/code> gibi uzant\u0131larla gelir. Bu dosyalar, Base64 kodlamal\u0131 ASCII metin bloklar\u0131 i\u00e7erir ve -----BEGIN CERTIFICATE-----<\/code> ile ba\u015flar, -----END CERTIFICATE-----<\/code> ile biter.<\/p>\n
Y\u00f6netilen Redis sa\u011flay\u0131c\u0131n\u0131zdan gerekli CA sertifikas\u0131n\u0131 (\u00f6rne\u011fin, ca_certificate.pem<\/code>) indirdi\u011finizden ve eri\u015filebilir bir yere kaydetti\u011finizden emin olun (\u00f6rne\u011fin, \/etc\/stunnel\/certs\/ca_certificate.pem<\/code> veya kullan\u0131c\u0131 ev dizininizdeki g\u00fcvenli bir konum).<\/p>\n
Stunnel Yap\u0131land\u0131rmas\u0131<\/h3>\n
stunnel<\/code>‘\u0131n \u00e7al\u0131\u015fmas\u0131 i\u00e7in bir yap\u0131land\u0131rma dosyas\u0131na ihtiyac\u0131 vard\u0131r. Bu dosya genellikle stunnel.conf<\/code> olarak adland\u0131r\u0131l\u0131r. Bu dosyay\u0131 \/etc\/stunnel\/<\/code> dizininde veya kullan\u0131c\u0131n\u0131n kendi \u00e7al\u0131\u015fma dizininde olu\u015fturabilirsiniz.<\/p>\n
A\u015fa\u011f\u0131da, y\u00f6netilen bir Redis \u00f6rne\u011fine ba\u011flanmak i\u00e7in tipik bir stunnel.conf<\/code> yap\u0131land\u0131rmas\u0131 bulunmaktad\u0131r.<\/p>\n
; stunnel.conf\n; Redis i\u00e7in istemci yap\u0131land\u0131rmas\u0131\n\n; Genel ayarlar\npid = \/var\/run\/stunnel.pid  ; Stunnel'\u0131n PID dosyas\u0131n\u0131n konumu\nsetuid = nobody             ; Stunnel'\u0131n \u00e7al\u0131\u015faca\u011f\u0131 kullan\u0131c\u0131 (g\u00fcvenlik i\u00e7in)\nsetgid = nogroup            ; Stunnel'\u0131n \u00e7al\u0131\u015faca\u011f\u0131 grup (g\u00fcvenlik i\u00e7in)\n; chroot = \/var\/stunnel     ; G\u00fcvenlik i\u00e7in chroot ortam\u0131 (iste\u011fe ba\u011fl\u0131)\nforeground = yes            ; Arka planda de\u011fil, \u00f6n planda \u00e7al\u0131\u015ft\u0131r (test i\u00e7in)\ndebug = 7                   ; Hata ay\u0131klama seviyesi (daha fazla bilgi i\u00e7in 7)\noutput = \/var\/log\/stunnel.log ; Log dosyas\u0131n\u0131n konumu\n\n; Redis servisi i\u00e7in istemci yap\u0131land\u0131rmas\u0131\n[redis-client]\nclient = yes\naccept = 127.0.0.1:6379     ; Stunnel'\u0131n dinleyece\u011fi yerel IP ve port\nconnect = YOUR_REDIS_HOST:YOUR_REDIS_TLS_PORT ; Y\u00f6netilen Redis \u00f6rne\u011finizin hostu ve TLS portu\n\n; Sunucu sertifikas\u0131n\u0131 do\u011frulamak i\u00e7in CA sertifikas\u0131\nCAfile = \/path\/to\/your\/ca_certificate.pem ; Y\u00f6netilen Redis sa\u011flay\u0131c\u0131n\u0131zdan ald\u0131\u011f\u0131n\u0131z CA sertifikas\u0131n\u0131n yolu\nverify = 2                  ; Sunucu sertifikas\u0131n\u0131 CAfile'a g\u00f6re do\u011frula (2 = zorunlu do\u011frulama)\n\n; Ek g\u00fcvenlik ayarlar\u0131 (iste\u011fe ba\u011fl\u0131, ancak \u00f6nerilir)\n; Bu ayarlar, TLS protokol versiyonlar\u0131n\u0131 ve \u015fifreleme algoritmalar\u0131n\u0131 k\u0131s\u0131tlar.\n; Y\u00f6netilen Redis hizmetinizin destekledi\u011fi versiyonlara g\u00f6re ayarlay\u0131n.\n; sslVersion = TLSv1.2      ; Sadece TLSv1.2 kullan\n; ciphers = HIGH:!aNULL:!kRSA:!PSK:!SRP:!DSS:!RC4:!MD5 ; G\u00fc\u00e7l\u00fc \u015fifreleme algoritmalar\u0131<\/code><\/pre>\n
Yap\u0131land\u0131rma A\u00e7\u0131klamalar\u0131:<\/strong><\/p>\n
*   pid<\/code><\/strong>: stunnel<\/code>‘\u0131n i\u015flem kimli\u011fini (PID) yazd\u0131\u011f\u0131 dosyan\u0131n yolunu belirtir.
\n*   setuid<\/code>, setgid<\/code><\/strong>: stunnel<\/code>‘\u0131n daha az ayr\u0131cal\u0131kl\u0131 bir kullan\u0131c\u0131 ve grup olarak \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar. Bu, g\u00fcvenlik i\u00e7in iyi bir uygulamad\u0131r. nobody<\/code> ve nogroup<\/code> genellikle sistemde bulunan varsay\u0131lan d\u00fc\u015f\u00fck ayr\u0131cal\u0131kl\u0131 kullan\u0131c\u0131lard\u0131r.
\n*   foreground = yes<\/code><\/strong>: stunnel<\/code>‘\u0131 \u00f6n planda \u00e7al\u0131\u015ft\u0131r\u0131r. Hata ay\u0131klama ve test i\u00e7in kullan\u0131\u015fl\u0131d\u0131r. \u00dcretimde genellikle no<\/code> olarak ayarlan\u0131r veya servis y\u00f6neticisi (systemd) taraf\u0131ndan kontrol edilir.
\n*   debug = 7<\/code><\/strong>: Hata ay\u0131klama seviyesini belirler. 7<\/code> en detayl\u0131 loglar\u0131 sa\u011flar. Sorun giderme i\u00e7in \u00e7ok faydal\u0131d\u0131r.
\n*   output<\/code><\/strong>: stunnel<\/code> loglar\u0131n\u0131n yaz\u0131laca\u011f\u0131 dosyay\u0131 belirtir.
\n*   [redis-client]<\/code><\/strong>: Bu bir servis tan\u0131m\u0131d\u0131r. K\u00f6\u015feli parantez i\u00e7indeki isim (redis-client<\/code>) rastgele se\u00e7ilebilir.
\n*   client = yes<\/code><\/strong>: stunnel<\/code>‘\u0131n bir istemci olarak \u00e7al\u0131\u015faca\u011f\u0131n\u0131 belirtir (yani, uzak bir sunucuya ba\u011flanacakt\u0131r).
\n*   accept = 127.0.0.1:6379<\/code><\/strong>: stunnel<\/code>‘\u0131n yerel makinede hangi IP adresinde ve portta dinleyece\u011fini belirtir. redis-cli<\/code> bu yerel adrese ba\u011flanacakt\u0131r. 6379<\/code> varsay\u0131lan Redis portudur, ancak \u00e7ak\u0131\u015fmay\u0131 \u00f6nlemek i\u00e7in farkl\u0131 bir port (\u00f6rne\u011fin, 127.0.0.1:6380<\/code>) kullanabilirsiniz.
\n*   connect = YOUR_REDIS_HOST:YOUR_REDIS_TLS_PORT<\/code><\/strong>: Y\u00f6netilen Redis \u00f6rne\u011finizin ger\u00e7ek host ad\u0131 ve TLS ba\u011flant\u0131lar\u0131 i\u00e7in kulland\u0131\u011f\u0131 portu buraya yazmal\u0131s\u0131n\u0131z. Bu de\u011ferleri kendi Redis \u00f6rne\u011finizin bilgileriyle de\u011fi\u015ftirin.<\/strong>
\n*   CAfile = \/path\/to\/your\/ca_certificate.pem<\/code><\/strong>: Y\u00f6netilen Redis hizmeti sa\u011flay\u0131c\u0131n\u0131zdan ald\u0131\u011f\u0131n\u0131z CA sertifikas\u0131n\u0131n tam yolunu buraya yazmal\u0131s\u0131n\u0131z. Bu yolu kendi sertifika dosyan\u0131z\u0131n konumuna g\u00f6re de\u011fi\u015ftirin.<\/strong>
\n*   verify = 2<\/code><\/strong>: Bu ayar, stunnel<\/code>‘\u0131n uzak sunucunun sertifikas\u0131n\u0131 CAfile<\/code>‘da belirtilen CA sertifikas\u0131na g\u00f6re do\u011frulamas\u0131 gerekti\u011fini belirtir.
\n    *   verify = 0<\/code>: Sunucu sertifikas\u0131n\u0131 do\u011frulama (g\u00fcvenli de\u011fil).
\n    *   verify = 1<\/code>: Sunucu sertifikas\u0131n\u0131 do\u011frula, ancak bir hata durumunda ba\u011flant\u0131y\u0131 kesme (uyar\u0131 ver).
\n    *   verify = 2<\/code>: Sunucu sertifikas\u0131n\u0131 do\u011frula ve do\u011frulama ba\u015far\u0131s\u0131z olursa ba\u011flant\u0131y\u0131 kes (\u015fiddetle tavsiye edilir).
\n    *   verify = 3<\/code>: verify = 2<\/code> ile ayn\u0131, ancak sertifika zincirindeki t\u00fcm sertifikalar\u0131 do\u011frular.
\n*   sslVersion<\/code> ve ciphers<\/code><\/strong>: Bu ayarlar, kullan\u0131lacak TLS protokol versiyonlar\u0131n\u0131 ve \u015fifreleme algoritmalar\u0131n\u0131 k\u0131s\u0131tlayarak g\u00fcvenli\u011fi art\u0131r\u0131r. Y\u00f6netilen Redis hizmetinizin destekledi\u011fi en g\u00fcncel ve g\u00fcvenli versiyonlar\u0131 ve algoritmalar\u0131 kullanman\u0131z \u00f6nerilir.<\/p>\n
Yap\u0131land\u0131rma dosyas\u0131n\u0131 olu\u015fturduktan sonra, onu kaydetmeyi unutmay\u0131n (\u00f6rne\u011fin, \/etc\/stunnel\/stunnel.conf<\/code>).<\/p>\n
Stunnel’\u0131 Ba\u015flatma ve Do\u011frulama<\/h3>\n
Yap\u0131land\u0131rma dosyas\u0131n\u0131 kaydettikten sonra stunnel<\/code>‘\u0131 ba\u015flatabiliriz.<\/p>\n
1.  Yap\u0131land\u0131rma Dosyas\u0131n\u0131n Kontrol\u00fc:<\/strong>
\n    stunnel<\/code>‘\u0131 ba\u015flatmadan \u00f6nce yap\u0131land\u0131rma dosyan\u0131z\u0131n s\u00f6zdizimini kontrol etmek iyi bir uygulamad\u0131r:<\/p>\n
stunnel -verify \/etc\/stunnel\/stunnel.conf<\/code><\/pre>\n
    Herhangi bir hata yoksa, \u00e7\u0131kt\u0131 genellikle bo\u015f olacakt\u0131r veya ba\u015far\u0131l\u0131 oldu\u011funu belirten bir mesaj g\u00f6sterecektir.<\/p>\n
2.  Stunnel’\u0131 Ba\u015flatma:<\/strong><\/p>\n
    *   \u00d6n Planda (Test Ama\u00e7l\u0131):<\/strong> Yap\u0131land\u0131rma dosyan\u0131zda foreground = yes<\/code> olarak ayarlad\u0131ysan\u0131z, stunnel<\/code>‘\u0131 do\u011frudan terminalden ba\u015flatabilirsiniz. Bu, hatalar\u0131 g\u00f6rmenizi kolayla\u015ft\u0131r\u0131r.<\/p>\n
sudo stunnel \/etc\/stunnel\/stunnel.conf<\/code><\/pre>\n
        sudo<\/code> kullanman\u0131z gerekebilir, \u00e7\u00fcnk\u00fc accept<\/code> portu (6379) 1024’ten k\u00fc\u00e7\u00fckt\u00fcr ve bu portlar ayr\u0131cal\u0131kl\u0131 eri\u015fim gerektirir.<\/p>\n
    *   Arka Planda (Servis Olarak):<\/strong> \u00dcretim ortam\u0131nda veya s\u00fcrekli \u00e7al\u0131\u015fmas\u0131 gereken durumlarda stunnel<\/code>‘\u0131 bir servis olarak \u00e7al\u0131\u015ft\u0131rmak istenir.
\n        *   systemd kullanan sistemler (Ubuntu 16.04+, CentOS 7+):<\/strong>
\n            stunnel4<\/code> (Ubuntu\/Debian) veya stunnel<\/code> (CentOS\/RHEL) paketi genellikle systemd<\/code> servis dosyalar\u0131yla birlikte gelir. Yap\u0131land\u0131rma dosyas\u0131n\u0131 \/etc\/stunnel\/stunnel.conf<\/code> olarak kaydettiyseniz, servisi ba\u015flatmak i\u00e7in:<\/p>\n
sudo systemctl enable stunnel4 # veya stunnel\n            sudo systemctl start stunnel4 # veya stunnel\n            sudo systemctl status stunnel4 # veya stunnel<\/code><\/pre>\n
            foreground = no<\/code> olarak ayarlad\u0131\u011f\u0131n\u0131zdan emin olun.<\/p>\n
3.  Stunnel’\u0131n \u00c7al\u0131\u015ft\u0131\u011f\u0131n\u0131 Do\u011frulama:<\/strong>
\n    stunnel<\/code> ba\u015far\u0131yla ba\u015flad\u0131ktan sonra, yerel accept<\/code> portunun dinlenip dinlenmedi\u011fini kontrol edebilirsiniz:<\/p>\n
sudo netstat -tulnp | grep 6379\n    # Veya daha modern bir ara\u00e7 olan ss ile\n    sudo ss -tulnp | grep 6379<\/code><\/pre>\n
    \u00c7\u0131kt\u0131da 127.0.0.1:6379<\/code> (veya yap\u0131land\u0131rd\u0131\u011f\u0131n\u0131z port) \u00fczerinde stunnel<\/code>‘\u0131n dinledi\u011fini g\u00f6steren bir sat\u0131r g\u00f6rmelisiniz.<\/p>\n
    Ayr\u0131ca, stunnel<\/code>‘\u0131n loglar\u0131n\u0131 kontrol ederek herhangi bir hata olup olmad\u0131\u011f\u0131n\u0131 g\u00f6rebilirsiniz:<\/p>\n
tail -f \/var\/log\/stunnel.log\n    # Veya systemd kullan\u0131yorsan\u0131z\n    sudo journalctl -u stunnel4 -f # veya stunnel<\/code><\/pre>\n
    Loglarda Configuration successful<\/code> veya Service [redis-client] accepted<\/code> gibi mesajlar g\u00f6rmelisiniz.<\/p>\n
redis-cli ile Ba\u011flanma<\/h3>\n
stunnel<\/code> t\u00fcneli ba\u015far\u0131yla kurulup \u00e7al\u0131\u015ft\u0131\u011f\u0131nda, redis-cli<\/code>‘yi kullanarak yerel stunnel<\/code> portuna ba\u011flanabilirsiniz. redis-cli<\/code> i\u00e7in bu, sanki yerel makinenizde bir Redis sunucusu \u00e7al\u0131\u015f\u0131yormu\u015f gibi olacakt\u0131r.<\/p>\n
redis-cli -h 127.0.0.1 -p 6379 -a YOUR_REDIS_PASSWORD<\/code><\/pre>\n
*   -h 127.0.0.1<\/code>: stunnel<\/code>‘\u0131n dinledi\u011fi yerel IP adresi.
\n*   -p 6379<\/code>: stunnel<\/code>‘\u0131n dinledi\u011fi yerel port.
\n*   -a YOUR_REDIS_PASSWORD<\/code>: Y\u00f6netilen Redis \u00f6rne\u011finiz i\u00e7in ayarlad\u0131\u011f\u0131n\u0131z kimlik do\u011frulama \u015fifresi (varsa). \u015eifre yoksa -a<\/code> parametresini kullanmay\u0131n.<\/p>\n
Ba\u011flant\u0131 ba\u015far\u0131l\u0131 olursa, redis-cli<\/code> komut istemini g\u00f6rmelisiniz. \u015eimdi Redis komutlar\u0131n\u0131 g\u00fcvenli bir \u015fekilde \u00e7al\u0131\u015ft\u0131rabilirsiniz:<\/p>\n
127.0.0.1:6379> PING\nPONG\n127.0.0.1:6379> SET mykey \"Hello from secure Redis!\"\nOK\n127.0.0.1:6379> GET mykey\n\"Hello from secure Redis!\"\n127.0.0.1:6379> INFO clients\n
Clients<\/h2>\nconnected_clients:2\nclient_recent_max_input_buffer:2\nclient_recent_max_output_buffer:0\nblocked_clients:0\n...<\/code><\/pre>\n
Bu komutlar, Redis \u00f6rne\u011finizle g\u00fcvenli bir \u015fekilde ileti\u015fim kurdu\u011funuzu do\u011frular.<\/p>\n
S\u0131k Kar\u015f\u0131la\u015f\u0131lan Sorunlar ve \u00c7\u00f6z\u00fcmleri<\/h3>\n
stunnel<\/code> ile ba\u011flant\u0131 kurarken \u00e7e\u015fitli sorunlarla kar\u015f\u0131la\u015fabilirsiniz. \u0130\u015fte baz\u0131 yayg\u0131n sorunlar ve olas\u0131 \u00e7\u00f6z\u00fcmleri:<\/p>\n
1. Sertifika Hatalar\u0131<\/h4>\n
Belirti:<\/strong> stunnel<\/code> loglar\u0131nda SSL_connect: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed<\/code> veya benzeri hatalar g\u00f6r\u00fcrs\u00fcn\u00fcz.
\nNeden:<\/strong>
\n*   CAfile<\/code> yolu yanl\u0131\u015f veya dosya okunam\u0131yor.
\n*   CAfile<\/code> yanl\u0131\u015f sertifikay\u0131 i\u00e7eriyor veya eksik bir zincire sahip.
\n*   Redis sunucusunun sertifikas\u0131 ge\u00e7ersiz (s\u00fcresi dolmu\u015f, host ad\u0131 uyu\u015fmuyor vb.).
\n*   verify<\/code> seviyesi \u00e7ok d\u00fc\u015f\u00fck (0) ve do\u011frulama yap\u0131lm\u0131yor, veya \u00e7ok y\u00fcksek (3) ve bir ara sertifika eksik.
\n\u00c7\u00f6z\u00fcm:<\/strong>
\n*   CAfile<\/code> yolunu ve dosya izinlerini kontrol edin. stunnel<\/code>‘\u0131n bu dosyay\u0131 okuyabilmesi gerekir.
\n*   Y\u00f6netilen Redis sa\u011flay\u0131c\u0131n\u0131zdan do\u011fru ve g\u00fcncel CA sertifikas\u0131n\u0131 indirdi\u011finizden emin olun. Bazen birden fazla CA sertifikas\u0131 birle\u015ftirilmi\u015f bir dosyada gerekebilir.
\n*   stunnel.conf<\/code> dosyas\u0131nda verify = 2<\/code> veya verify = 3<\/code> kulland\u0131\u011f\u0131n\u0131zdan emin olun.
\n*   debug = 7<\/code> ayar\u0131n\u0131 kullanarak daha fazla bilgi edinin.<\/p>\n
2. Ba\u011flant\u0131 Reddi veya Zaman A\u015f\u0131m\u0131<\/h4>\n
Belirti:<\/strong> stunnel<\/code> loglar\u0131nda connect: Connection refused<\/code> veya connect: Operation timed out<\/code> gibi hatalar g\u00f6r\u00fcrs\u00fcn\u00fcz. redis-cli<\/code>‘den ba\u011flant\u0131 denedi\u011finizde Could not connect to Redis at 127.0.0.1:6379: Connection refused<\/code> hatas\u0131 al\u0131rs\u0131n\u0131z.
\nNeden:<\/strong>
\n*   connect<\/code> adresindeki Redis hostu veya TLS portu yanl\u0131\u015f.
\n*   Y\u00f6netilen Redis \u00f6rne\u011finin g\u00fcvenlik grubu veya g\u00fcvenlik duvar\u0131 kurallar\u0131 stunnel<\/code>‘\u0131n IP adresinden gelen ba\u011flant\u0131lara izin vermiyor.
\n*   Redis \u00f6rne\u011fi \u00e7al\u0131\u015fm\u0131yor veya TLS ba\u011flant\u0131lar\u0131n\u0131 kabul etmiyor.
\n*   Yerel makinenizdeki g\u00fcvenlik duvar\u0131 stunnel<\/code>‘\u0131n d\u0131\u015far\u0131ya ba\u011flant\u0131 kurmas\u0131n\u0131 engelliyor.
\n\u00c7\u00f6z\u00fcm:<\/strong>
\n*   connect<\/code> ayar\u0131ndaki host ve portu iki kez kontrol edin.
\n*   Y\u00f6netilen Redis hizmetinizin g\u00fcvenlik grubu veya a\u011f ACL’lerini kontrol edin ve stunnel<\/code>‘\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131 makinenin IP adresinden gelen ba\u011flant\u0131lara (belirtilen TLS portu \u00fczerinden) izin verildi\u011finden emin olun.
\n*   Redis \u00f6rne\u011finin durumunu kontrol edin.
\n*   Yerel g\u00fcvenlik duvar\u0131n\u0131z\u0131 (iptables, firewalld, ufw) kontrol edin ve stunnel<\/code>‘\u0131n d\u0131\u015far\u0131ya ba\u011flant\u0131 kurmas\u0131na izin verildi\u011finden emin olun.<\/p>\n
3. Stunnel Ba\u015flam\u0131yor<\/h4>\n
Belirti:<\/strong> stunnel<\/code> komutunu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda hi\u00e7bir \u015fey olmuyor veya hata mesaj\u0131 al\u0131yorsunuz.
\nNeden:<\/strong>
\n*   stunnel.conf<\/code> dosyas\u0131nda s\u00f6zdizimi hatas\u0131 var.
\n*   pid<\/code> dosyas\u0131 veya output<\/code> dosyas\u0131 i\u00e7in yazma izinleri yok.
\n*   accept<\/code> portu ba\u015fka bir uygulama taraf\u0131ndan zaten kullan\u0131l\u0131yor.
\n*   setuid<\/code>\/setgid<\/code> i\u00e7in belirtilen kullan\u0131c\u0131\/grup mevcut de\u011fil veya yanl\u0131\u015f.
\n\u00c7\u00f6z\u00fcm:<\/strong>
\n*   stunnel -verify \/etc\/stunnel\/stunnel.conf<\/code> komutuyla yap\u0131land\u0131rma dosyas\u0131n\u0131 do\u011frulay\u0131n.
\n*   pid<\/code> ve output<\/code> dosyalar\u0131n\u0131n yazma izinlerini kontrol edin. Gerekirse sudo<\/code> ile \u00e7al\u0131\u015ft\u0131r\u0131n.
\n*   accept<\/code> portunu (\u00f6rne\u011fin, 6379) netstat -tulnp<\/code> veya ss -tulnp<\/code> ile kontrol edin. Ba\u015fka bir uygulama kullan\u0131yorsa, stunnel.conf<\/code> dosyas\u0131nda farkl\u0131 bir port (\u00f6rne\u011fin, 127.0.0.1:6380<\/code>) kullan\u0131n.
\n*   setuid<\/code> ve setgid<\/code> de\u011ferlerini nobody<\/code>\/nogroup<\/code> olarak ayarlad\u0131ysan\u0131z, bu kullan\u0131c\u0131lar\u0131n\/gruplar\u0131n sisteminizde mevcut oldu\u011fundan emin olun.<\/p>\n
4. redis-cli Ba\u011flanam\u0131yor, Stunnel \u00c7al\u0131\u015f\u0131yor<\/h4>\n
Belirti:<\/strong> stunnel<\/code> sorunsuz \u00e7al\u0131\u015f\u0131yor ve yerel portu dinliyor gibi g\u00f6r\u00fcn\u00fcyor, ancak redis-cli<\/code> ba\u011flanam\u0131yor.
\nNeden:<\/strong>
\n*   redis-cli<\/code>‘ye yanl\u0131\u015f IP adresi veya port veriliyor (yerel stunnel<\/code> portu yerine uzak Redis portu gibi).
\n*   stunnel<\/code>‘\u0131n accept<\/code> adresi 127.0.0.1<\/code> yerine 0.0.0.0<\/code> olarak ayarlanm\u0131\u015f olabilir, ancak redis-cli<\/code> 127.0.0.1<\/code>‘e ba\u011flanmaya \u00e7al\u0131\u015f\u0131yor.
\n*   stunnel<\/code>‘\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131 makine ile redis-cli<\/code>‘nin \u00e7al\u0131\u015ft\u0131\u011f\u0131 makine farkl\u0131 ve g\u00fcvenlik duvar\u0131 stunnel<\/code>‘\u0131n accept<\/code> portuna eri\u015fimi engelliyor.
\n\u00c7\u00f6z\u00fcm:<\/strong>
\n*   redis-cli -h 127.0.0.1 -p 6379<\/code> (veya stunnel<\/code>‘\u0131n accept<\/code> olarak ayarlad\u0131\u011f\u0131 IP ve port) kulland\u0131\u011f\u0131n\u0131zdan emin olun.
\n*   E\u011fer redis-cli<\/code>‘yi farkl\u0131 bir makineden \u00e7al\u0131\u015ft\u0131r\u0131yorsan\u0131z, stunnel.conf<\/code>‘taki accept<\/code> ayar\u0131n\u0131 0.0.0.0:6379<\/code> olarak de\u011fi\u015ftirin ve stunnel<\/code>‘\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131 makinedeki g\u00fcvenlik duvar\u0131n\u0131n bu porta d\u0131\u015far\u0131dan eri\u015fime izin verdi\u011finden emin olun. Ancak bu, g\u00fcvenlik riskleri ta\u015f\u0131r ve sadece gerekli durumlarda ve s\u0131k\u0131 g\u00fcvenlik kurallar\u0131yla yap\u0131lmal\u0131d\u0131r.<\/p>\n
5. Performans Sorunlar\u0131<\/h4>\n
Belirti:<\/strong> stunnel<\/code> \u00fczerinden Redis’e ba\u011fland\u0131\u011f\u0131n\u0131zda gecikme veya daha d\u00fc\u015f\u00fck verim fark ediyorsunuz.
\nNeden:<\/strong>
\n*   TLS \u015fifrelemesi ve \u00e7\u00f6zme i\u015flemleri ek CPU y\u00fck\u00fc getirir.
\n*   A\u011f gecikmesi veya bant geni\u015fli\u011fi k\u0131s\u0131tlamalar\u0131.
\n*   stunnel<\/code>‘\u0131n kendisi bir darbo\u011faz olu\u015fturuyor (nadiren).
\n\u00c7\u00f6z\u00fcm:<\/strong>
\n*   TLS \u015fifrelemesinin do\u011fas\u0131 gere\u011fi bir miktar performans ek y\u00fck\u00fc beklenebilir. Bu genellikle kabul edilebilir d\u00fczeydedir.
\n*   stunnel<\/code>‘\u0131n kaynak kullan\u0131m\u0131n\u0131 (CPU, bellek) izleyin.
\n*   stunnel.conf<\/code> dosyas\u0131nda sslVersion<\/code> ve ciphers<\/code> ayarlar\u0131n\u0131 optimize ederek daha h\u0131zl\u0131 \u015fifreleme algoritmalar\u0131n\u0131 tercih edebilirsiniz, ancak bu g\u00fcvenlikten \u00f6d\u00fcn vermemeli.
\n*   Y\u00fcksek trafikli senaryolarda, Redis’in kendisinin yerel TLS deste\u011fini (Redis 6+) veya do\u011frudan TLS destekleyen Redis istemci k\u00fct\u00fcphanelerini kullanmak daha verimli olabilir.<\/p>\n
G\u00fcvenlik \u0130pu\u00e7lar\u0131 ve En \u0130yi Uygulamalar<\/h3>\n
stunnel<\/code> kullanarak g\u00fcvenli bir Redis ba\u011flant\u0131s\u0131 kurarken, a\u015fa\u011f\u0131daki g\u00fcvenlik ipu\u00e7lar\u0131n\u0131 ve en iyi uygulamalar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurman\u0131z \u00f6nemlidir:<\/p>\n
*   En Az Ayr\u0131cal\u0131k Prensibi:<\/strong> stunnel<\/code>‘\u0131 root<\/code> olarak \u00e7al\u0131\u015ft\u0131rmay\u0131n. stunnel.conf<\/code> i\u00e7inde setuid<\/code> ve setgid<\/code> ayarlar\u0131n\u0131 kullanarak nobody<\/code> veya benzeri d\u00fc\u015f\u00fck ayr\u0131cal\u0131kl\u0131 bir kullan\u0131c\u0131 alt\u0131nda \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flay\u0131n.
\n*   Sertifika Do\u011frulamas\u0131n\u0131 Her Zaman Kullan\u0131n:<\/strong> stunnel.conf<\/code> dosyas\u0131nda verify = 2<\/code> veya verify = 3<\/code> ayar\u0131n\u0131 mutlaka kullan\u0131n. Bu, Man-in-the-Middle sald\u0131r\u0131lar\u0131na kar\u015f\u0131 korunman\u0131z\u0131 sa\u011flar. CAfile<\/code> yolunun do\u011fru oldu\u011fundan ve CA sertifikas\u0131n\u0131n g\u00fcncel oldu\u011fundan emin olun.
\n*   G\u00fc\u00e7l\u00fc \u015eifreler ve Redis ACL’leri:<\/strong> Redis \u00f6rne\u011finiz i\u00e7in her zaman g\u00fc\u00e7l\u00fc bir AUTH<\/code> \u015fifresi kullan\u0131n. Redis 6 ve sonras\u0131 s\u00fcr\u00fcmlerde, kullan\u0131c\u0131 tabanl\u0131 eri\u015fim kontrol listeleri (ACL’ler) kullanarak farkl\u0131 kullan\u0131c\u0131lara farkl\u0131 izinler verebilirsiniz.
\n*   G\u00fcvenlik Duvar\u0131 Kurallar\u0131:<\/strong>
\n    *   stunnel<\/code>‘\u0131n accept<\/code> portuna (\u00f6rne\u011fin, 127.0.0.1:6379<\/code>) sadece redis-cli<\/code>‘nin veya di\u011fer istemcilerin \u00e7al\u0131\u015ft\u0131\u011f\u0131 makineden eri\u015fime izin verin. Genellikle 127.0.0.1<\/code>‘e ba\u011flamak en g\u00fcvenlisidir.
\n    *   stunnel<\/code>‘\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131 makineden uzak Redis \u00f6rne\u011fine sadece TLS portu \u00fczerinden (\u00f6rne\u011fin, 6379 veya 6380) ba\u011flant\u0131 kurmas\u0131na izin veren g\u00fcvenlik duvar\u0131 kurallar\u0131 tan\u0131mlay\u0131n.
\n*   Stunnel ve Sistem G\u00fcncellemeleri:<\/strong> stunnel<\/code> uygulamas\u0131n\u0131 ve i\u015fletim sisteminizi d\u00fczenli olarak g\u00fcncel tutun. Bu, bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131na kar\u015f\u0131 korunman\u0131z\u0131 sa\u011flar.
\n*   Loglama ve \u0130zleme:<\/strong> stunnel<\/code> loglar\u0131n\u0131 d\u00fczenli olarak izleyin (output<\/code> ayar\u0131). Anormal ba\u011flant\u0131 giri\u015fimleri veya sertifika hatalar\u0131 gibi durumlar i\u00e7in uyar\u0131lar ayarlay\u0131n.
\n*   Sertifika Y\u00f6netimi:<\/strong> CA sertifikalar\u0131n\u0131z\u0131n s\u00fcresinin dolmad\u0131\u011f\u0131ndan ve g\u00fcncel oldu\u011fundan emin olun. Y\u00f6netilen hizmet sa\u011flay\u0131c\u0131lar\u0131 bazen CA sertifikalar\u0131n\u0131 g\u00fcncelleyebilir, bu durumda sizin de CAfile<\/code>‘\u0131n\u0131z\u0131 g\u00fcncellemeniz gerekir.
\n*   Minimal Yap\u0131land\u0131rma:<\/strong> stunnel.conf<\/code> dosyas\u0131nda sadece gerekli ayarlar\u0131 kullan\u0131n. Gereksiz veya potansiyel olarak zay\u0131f ayarlar\u0131 etkinle\u015ftirmekten ka\u00e7\u0131n\u0131n. \u00d6zellikle sslVersion<\/code> ve ciphers<\/code> ayarlar\u0131n\u0131 en g\u00fcvenli protokollere ve \u015fifreleme s\u00fcitlerine k\u0131s\u0131tlamak \u00f6nemlidir.<\/p>\n
Sonu\u00e7<\/h3>\n
Y\u00f6netilen bir Redis \u00f6rne\u011fine stunnel<\/code> ve redis-cli<\/code> kullanarak TLS \u00fczerinden g\u00fcvenli bir \u015fekilde ba\u011flanmak, veri g\u00fcvenli\u011fini art\u0131rman\u0131n ve hassas bilgileri a\u011fdaki tehditlere kar\u015f\u0131 koruman\u0131n etkili bir yoludur. redis-cli<\/code> gibi do\u011frudan TLS deste\u011fi olmayan ara\u00e7lar i\u00e7in stunnel<\/code>, \u015feffaf bir TLS t\u00fcneli sa\u011flayarak bu a\u00e7\u0131\u011f\u0131 kapat\u0131r.<\/p>\n
Bu makalede, stunnel<\/code>‘\u0131n kurulumundan yap\u0131land\u0131rmas\u0131na, TLS sertifikalar\u0131n\u0131n \u00f6neminden s\u0131k kar\u015f\u0131la\u015f\u0131lan sorunlara ve g\u00fcvenlik ipu\u00e7lar\u0131na kadar t\u00fcm s\u00fcre\u00e7 detayl\u0131 bir \u015fekilde ele al\u0131nm\u0131\u015ft\u0131r. Do\u011fru yap\u0131land\u0131rma ve g\u00fcvenlik uygulamalar\u0131yla, Redis verilerinizi a\u011f \u00fczerinde g\u00fcvenle ta\u015f\u0131yabilir ve uygulamalar\u0131n\u0131z\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc koruyabilirsiniz. Unutmay\u0131n, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve sistemlerinizi g\u00fcncel tutmak, en iyi uygulamalar\u0131 takip etmek her zaman \u00f6nemlidir.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma\nBu makalede, y\u00f6netilen bir Redis \u00f6rne\u011fine g\u00fcvenli bir \u015fekilde","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1404],"tags":[],"class_list":{"0":"post-33514","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-redis","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nY\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma\" \/>\n<meta property=\"og:description\" content=\"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma Bu makalede, y\u00f6netilen bir Redis \u00f6rne\u011fine g\u00fcvenli bir \u015fekilde\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-03T18:41:25+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma\",\"datePublished\":\"2025-11-03T18:41:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/\"},\"wordCount\":3219,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Redis\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/\",\"name\":\"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-03T18:41:25+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/","og_locale":"tr_TR","og_type":"article","og_title":"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma","og_description":"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma Bu makalede, y\u00f6netilen bir Redis \u00f6rne\u011fine g\u00fcvenli bir \u015fekilde","og_url":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-03T18:41:25+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"19 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma","datePublished":"2025-11-03T18:41:25+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/"},"wordCount":3219,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Redis"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/","url":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/","name":"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-03T18:41:25+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/yonetilen-bir-redis-ornegine-tls-uzerinden-stunnel-ve-redis-cli-ile-baglanma\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Y\u00f6netilen Bir Redis \u00d6rne\u011fine TLS \u00dczerinden Stunnel ve redis-cli ile Ba\u011flanma"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=33514"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33514\/revisions"}],"predecessor-version":[{"id":33515,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33514\/revisions\/33515"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=33514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=33514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=33514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}