I have searched the existing issues and discussions.
Problem Description
I am attempting to install Open WebUI via Helm chart, and have provided the following chart values relevant to the websocket connection to an existing Valkey cluster:
Since the Valkey cluster requires connections over TLS (and optionally mTLS), and that TLS cert was issued by a private CA, I know I need to either disable server certificate verification or provide the CA cert to the Redis client.
But I couldn't find any environment variables related to such settings.
So, as expected, this is the output from the open-webui-0 container:
2025-07-25 03:30:36.788 | ERROR | asyncio.runners:run:118 - Task exception was never retrieved
future: <Task finished name='Task-3' coro=<periodic_usage_pool_cleanup() done, defined at
/app/backend/open_webui/socket/main.py:133> exception=ConnectionError('Error 1
connecting to valkey-0-svc.valkey.svc.cluster.local:6379. [SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: unable to get local issuer certificate (_ssl.c:1016).')>
Desired Solution you'd like
Either an interim workaround to disable TLS certificate verification on external Redis connections, or provide addtional environment variables to fully support mTLS connections.
Suggested environment variables:
REDIS_USE_TLS — True or False(default)
REDIS_CA_CERTIFICATE — path to CA cert file, e.g. /certs/ca.crt
REDIS_CLIENT_CERTIFICATE — path to client cert file, e.g. /certs/tls.crt
REDIS_CLIENT_KEY — path to client key file, e.g. /certs/tls.key
Alternatives Considered
No response
Additional Context
No response
Originally created by @erhhung on GitHub (Jul 25, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/16018
### Check Existing Issues
- [x] I have searched the existing issues and discussions.
### Problem Description
I am attempting to install Open WebUI via Helm chart, and have provided the following chart values relevant to the websocket connection to an existing Valkey cluster:
```yaml
websocket:
enabled: true
manager: redis
redis:
enabled: false
url: rediss://:secret@valkey-0-svc.valkey.svc.cluster.local:6379/0
```
Since the Valkey cluster requires connections over TLS (and optionally mTLS), and that TLS cert was issued by a private CA, I know I need to either disable server certificate verification or provide the CA cert to the Redis client.
But I couldn't find any [environment variables](https://docs.openwebui.com/getting-started/env-configuration/#redis) related to such settings.
So, as expected, this is the output from the `open-webui-0` container:
```
2025-07-25 03:30:36.788 | ERROR | asyncio.runners:run:118 - Task exception was never retrieved
future: <Task finished name='Task-3' coro=<periodic_usage_pool_cleanup() done, defined at
/app/backend/open_webui/socket/main.py:133> exception=ConnectionError('Error 1
connecting to valkey-0-svc.valkey.svc.cluster.local:6379. [SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: unable to get local issuer certificate (_ssl.c:1016).')>
```
### Desired Solution you'd like
Either an **interim workaround** to **disable TLS certificate verification** on external Redis connections, or provide **addtional environment variables** to fully support mTLS connections.
Suggested environment variables:
* `REDIS_USE_TLS` — `True` or `False` _(default)_
* `REDIS_CA_CERTIFICATE` — path to CA cert file, e.g. `/certs/ca.crt`
* `REDIS_CLIENT_CERTIFICATE` — path to client cert file, e.g. `/certs/tls.crt`
* `REDIS_CLIENT_KEY` — path to client key file, e.g. `/certs/tls.key`
### Alternatives Considered
_No response_
### Additional Context
_No response_
Upon further investigation, it turns out that TLS connections are already supported through redis-py's ability to accept connection options as query params directly in the Redis connection URL (see examples).
So, using a rediss:// connection URL like the following works:
The query param names are the same as the kwarg param names of the Redis client.
In my case, though, getting past this TLS issue isn't the only problem, as my Valkey cluster requires cluster support on the client-side by using redis.cluster.RedisCluster and redis.asyncio.cluster.RedisCluster, which isn't implemented in utils/redis.py at the moment.
So I'll close this issue and file a separate one for cluster mode support...
<!-- gh-comment-id:3120517369 -->
@erhhung commented on GitHub (Jul 25, 2025):
Upon further investigation, it turns out that TLS connections are **already** supported through `redis-py`'s ability to accept connection options as query [params](https://redis.readthedocs.io/en/stable/connections.html) directly in the Redis connection URL _(see [examples](https://redis.readthedocs.io/en/stable/examples/ssl_connection_examples.html))_.
So, using a `rediss://` connection URL like the following works:
```
rediss://:secret@valkey-0-svc.valkey.svc.cluster.local:6379/0?ssl_cert_reqs=required&ssl_certfile=/tls/valkey/tls.crt&ssl_keyfile=/tls/valkey/tls.key&ssl_ca_certs=/tls/valkey/ca.crt
```
The query param names are the same as the kwarg param names of the Redis client.
In my case, though, getting past this TLS issue isn't the only problem, as my Valkey **cluster** requires cluster support on the client-side by using `redis.cluster.RedisCluster` and `redis.asyncio.cluster.RedisCluster`, which isn't implemented in [`utils/redis.py`](/open-webui/open-webui/blob/main/backend/open_webui/utils/redis.py) at the moment.
So I'll close this issue and file a separate one for cluster mode support...
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @erhhung on GitHub (Jul 25, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/16018
Check Existing Issues
Problem Description
I am attempting to install Open WebUI via Helm chart, and have provided the following chart values relevant to the websocket connection to an existing Valkey cluster:
Since the Valkey cluster requires connections over TLS (and optionally mTLS), and that TLS cert was issued by a private CA, I know I need to either disable server certificate verification or provide the CA cert to the Redis client.
But I couldn't find any environment variables related to such settings.
So, as expected, this is the output from the
open-webui-0container:Desired Solution you'd like
Either an interim workaround to disable TLS certificate verification on external Redis connections, or provide addtional environment variables to fully support mTLS connections.
Suggested environment variables:
REDIS_USE_TLS—TrueorFalse(default)REDIS_CA_CERTIFICATE— path to CA cert file, e.g./certs/ca.crtREDIS_CLIENT_CERTIFICATE— path to client cert file, e.g./certs/tls.crtREDIS_CLIENT_KEY— path to client key file, e.g./certs/tls.keyAlternatives Considered
No response
Additional Context
No response
@tjbck commented on GitHub (Jul 25, 2025):
PR Welcome!
@erhhung commented on GitHub (Jul 25, 2025):
Upon further investigation, it turns out that TLS connections are already supported through
redis-py's ability to accept connection options as query params directly in the Redis connection URL (see examples).So, using a
rediss://connection URL like the following works:The query param names are the same as the kwarg param names of the Redis client.
In my case, though, getting past this TLS issue isn't the only problem, as my Valkey cluster requires cluster support on the client-side by using
redis.cluster.RedisClusterandredis.asyncio.cluster.RedisCluster, which isn't implemented inutils/redis.pyat the moment.So I'll close this issue and file a separate one for cluster mode support...