@@ -226,6 +226,39 @@ def extract_cluster_fqdn(url):
226226 return f"https://{ cleaned_hostname } "
227227
228228
229+ def _prepare_ssl_certificates (cert_chain : bool ) -> dict :
230+ """
231+ Prepare SSL certificates for Redis cluster connection.
232+
233+ Args:
234+ cert_chain: PEM-encoded certificate chain containing client cert + intermediate + CA cert.
235+ This is the full certificate chain that will be used to validate the server.
236+
237+ Returns:
238+ dict: SSL configuration kwargs for RedisCluster
239+ """
240+ certs_config_path = os .environ .get ("MTLS_CONFIG_PATH" , None )
241+
242+ if not cert_chain :
243+ return {
244+ "ssl_cert_reqs" : "none" ,
245+ "ssl_check_hostname" : False ,
246+ }
247+
248+ if not certs_config_path :
249+ raise ValueError (
250+ "MTLS enabled test is triggered but MTLS_CONFIG_PATH environment variable not set"
251+ )
252+
253+ # The cert_chain contains the full chain (client cert + intermediate + root CA)
254+ # Use it as CA data for validating the server's certificate
255+ return {
256+ "ssl_cert_reqs" : "none" ,
257+ "ssl_keyfile" : os .path .join (certs_config_path , "client.key" ),
258+ "ssl_certfile" : os .path .join (certs_config_path , "client.crt" ),
259+ }
260+
261+
229262@pytest .fixture ()
230263def client_maint_notifications (endpoints_config ):
231264 return _get_client_maint_notifications (endpoints_config )
@@ -307,8 +340,8 @@ def get_cluster_client_maint_notifications(
307340 enable_relaxed_timeout : bool = True ,
308341 enable_proactive_reconnect : bool = True ,
309342 disable_retries : bool = False ,
343+ auth_ssl_client_certs : bool = False ,
310344 socket_timeout : Optional [float ] = None ,
311- host_config : Optional [str ] = None ,
312345):
313346 """Create Redis cluster client with maintenance notifications enabled."""
314347 # Get credentials from the configuration
@@ -337,6 +370,13 @@ def get_cluster_client_maint_notifications(
337370 tls_enabled = True if parsed .scheme == "rediss" else False
338371 logging .info (f"TLS enabled: { tls_enabled } " )
339372
373+ tls_kwargs = {"ssl" : tls_enabled }
374+
375+ if tls_enabled :
376+ # Prepare SSL certificate configuration
377+ ssl_config = _prepare_ssl_certificates (auth_ssl_client_certs )
378+ tls_kwargs .update (ssl_config )
379+
340380 # Configure maintenance notifications
341381 maintenance_config = MaintNotificationsConfig (
342382 enabled = enable_maintenance_notifications ,
@@ -352,12 +392,10 @@ def get_cluster_client_maint_notifications(
352392 socket_timeout = CLIENT_TIMEOUT if socket_timeout is None else socket_timeout ,
353393 username = username ,
354394 password = password ,
355- ssl = tls_enabled ,
356- ssl_cert_reqs = "none" ,
357- ssl_check_hostname = False ,
358395 protocol = protocol , # RESP3 required for push notifications
359396 maint_notifications_config = maintenance_config ,
360397 retry = retry ,
398+ ** tls_kwargs ,
361399 )
362400 logging .info ("Redis cluster client created with maintenance notifications enabled" )
363401 logging .info (
0 commit comments