TLS Connection - Beats to Redis - ssl

Question

I have Winlogbeat installed on a Windows box using Redis output.
The Redis server is configured for TLS on port 6380.
Both ends start services up successfully but the connection does not succeed. I have tried different combinations of protocols and cipher suites but no luck. What am I missing? The error messages:
Redis:
Error accepting a client connection: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher
Windows:
ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to redis(tcp://10.1.1.4:6380): remote error: tls: handshake failure
Here is the redis-server config. The CA is self-signed, 2048-bit key and x509 certificate. The server certificate is also x509. I think I may need to rebuild the CA, but feedback is appreciated on this.
#tls configs
tls-port 6380
tls-cert-file /etc/ssl/redis.crt
tls-key-file /etc/ssl/private/redis.key
tls-ca-cert-file /usr/local/share/ca-certificates/ca.crt
tls-auth-clients no
tls-prefer-server-ciphers no
tls-protocols "TLSv1.2"
tls-dh-params-file /etc/ssl/redis.dh
tls-ciphers DEFAULT
tls-ciphersuites ECDHE-ECDSA-CHACHA20-POLY1305
And the Beats config.
output.redis:
hosts: ["10.1.1.4:6380"]
password: "redispass"
key: "winlogbeat"
db: 0
timeout: 5
data_type: "list"
ssl:
enabled: true
certificate_authorities: ["C:\\Program Data\\Winlogbeat\\ca.crt"]
insecure: true
supported_protocols: [TLSv1.2]
cipher_suites: [ECDHE-ECDSA-CHACHA20-POLY1305]
curve_types: [P-256]

Answer 1

Finally worked it out, in case anyone is interested.
Needed to install and configure the CA with proper params, and then create a SAN server certificate for Redis using IP addresses and a hostname. Here are the articles I followed.
On the server that hosts Redis, create the root CA: https://blog.devolutions.net/2020/07/tutorial-how-to-generate-secure-self-signed-server-and-client-certificates-with-openssl (just the root CA from this article).
Create the Redis server certificate using IP address subject alternative names: https://www.golinuxcloud.com/openssl-generate-csr-create-san-certificate/
Install Redis from source with TLS support: https://godfrey-tutu.medium.com/redis-6-deployment-with-tls-authentication-on-centos-7-8b6e34d11cd0
Beats and Redis will negotiate best encryption. If you keep the existing Redis config and add the TLS piece on a different unused port, then Redis will start up and listen on both.
Here is the new Beat config:
output.redis:
hosts: ["10.1.1.4:6380"]
password: "redispass"
key: "winlogbeat"
db: 0
timeout: 5
data_type: "list"
ssl:
enabled: true
certificate_authorities: ["C:\\Program Data\\Winlogbeat\\ca.crt"]
insecure: true
supported_protocols: [TLSv1.1, TLSv1.2]
And Redis...
tls-port 6380
tls-cert-file /etc/pki/tls/certs/redis.crt
tls-key-file /etc/pki/tls/private/redis.key
tls-ca-cert-file /etc/pki/tls/certs/ca.crt
tls-auth-clients no
tls-protocols "TLSv1.1 TLSv1.2"
tls-prefer-server-ciphers yes