Memorystore

for {
  clientOptions <- createClientOptions(redisConfig)
  redis         <- Redis[F].withOptions(url, clientOptions, RedisCodec.Utf8)
} yield redis

private def createClientOptions[F[_]: Sync](redisConfig: RedisConfig): Resource[F, ClientOptions] =
  getCertificate(redisConfig).map { certificate =>
    val keystore            = createKeystoreWithCertificate(certificate)
    val trustManagerFactory = createTrustManagerFactory(keystore)
    val sslOptions          = createSslOptions(trustManagerFactory, redisConfig.sniHostName)

    ClientOptions
      .builder()
      .sslOptions(sslOptions)
      .build()
  }

private def getCertificate[F[_]: Sync](redisConfig: RedisConfig): Resource[F, Certificate] =
  Resource
    .liftF(
      redisConfig.caCert
        .map(Applicative[F].pure(_))
        .getOrElse(Sync[F].delay(Files.readString(Paths.get(redisConfig.caFile))))
    )
    .map(createCertificateFromString)

private def createCertificateFromString(certificate: String): Certificate =
  CertificateFactory
    .getInstance("X.509")
    .generateCertificate(new ByteArrayInputStream(certificate.getBytes))

private def createKeystoreWithCertificate(certificate: Certificate, password: Array[Char] = Array.empty) = {
  val keyStore = KeyStore.getInstance("jks")
  keyStore.load(null, password)
  keyStore.setCertificateEntry("localhost", certificate)
  keyStore
}

private def createTrustManagerFactory(trustStore: KeyStore) = {
  val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm)
  trustManagerFactory.init(trustStore)
  trustManagerFactory
}

private def createSslOptions[F[_]: Sync](trustManagerFactory: TrustManagerFactory, sniHostNameO: Option[String]) = {
  val sslParameters = new SSLParameters()
  sniHostNameO.foreach { sniHostName =>
    sslParameters.setServerNames(List[SNIServerName](new SNIHostName(sniHostName)).asJava)
  }

  SslOptions
    .builder()
    .trustManager(trustManagerFactory)
    .sslParameters(() => sslParameters)
    .build()
}

public Jedis createJedisClient() {
    final URI uri = URI.create("rediss://<your-app-name>-redis:6379");
    final SSLSocketFactory sslSocketFactory = createTrustStoreSslSocketFactory();
    final NoopHostnameVerifier noopHostnameVerifier = new NoopHostnameVerifier();
    final SSLParameters sslParameters = createSslParameters();
    final JedisShardInfo shardInfo = new JedisShardInfo(uri, sslSocketFactory, sslParameters, noopHostnameVerifier);
    return new Jedis(shardInfo);
}

private SSLParameters createSslParameters() {
    SSLParameters sslParameters = new SSLParameters();
    sslParameters.setServerNames(List.of(new SNIHostName("redis")));
    return sslParameters;
}

private SSLSocketFactory createTrustStoreSslSocketFactory() {
    try {
        InputStream inputStream = new FileInputStream("/ca/ca.crt");
        Certificate certificate = CertificateFactory.getInstance("X.509")
            .generateCertificate(new ByteArrayInputStream(inputStream.readAllBytes()));
        KeyStore keyStore = KeyStore.getInstance("jks");
        keyStore.load(null, new char[0]);
        keyStore.setCertificateEntry("redis", certificate);

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(keyStore);
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustManagers, new SecureRandom());
        return sslContext.getSocketFactory();
    } catch (Exception exception) {
        throw new RuntimeException(exception);
    }
}

package main

import (
  "crypto/tls"
  "crypto/x509"
  "github.com/go-redis/redis/v8"
)

func getRedisConfig(certificateFilePath, keyFilePath, caFilePath) *redis.Options {
	cert, err := tls.LoadX509KeyPair(certificateFilePath, keyFilePath)
	if err != nil {
		log.Fatal(err)
	}

	caCert, err := ioutil.ReadFile(c.CAFilePath)
	if err != nil {
		log.Fatal(err)
	}
	rootCAPool := x509.NewCertPool()
	rootCAPool.AppendCertsFromPEM(caCert)

	redisConfig := &redis.Options{
		Addr: fmt.Sprintf("%s:%d", c.RedisHostname, c.RedisPort),
		DB:   0,
		TLSConfig: &tls.Config{
			ServerName:   c.RedisHostname,
			Certificates: []tls.Certificate{cert},
			RootCAs:      rootCAPool,
		},
	}
	if c.RedisPassword != "" {
		redisConfig.Password = c.RedisPassword
	}
	return redisConfig
}

func main() {
  config := getRedisConfig("/certs/redis.crt", "/certs/redis.key", "/ca/ca.crt");
  redisClient := redis.NewClient(config)
  defer redisClient.Close()
}