- TLS Refactoring

common/utils/cache/regions.py

@@ -42,24 +42,15 @@ def get_redis_config(app):
             'password': redis_uri.password
         })
 
-    # SSL support using Dogpile's built-in mechanism
-    cert_data = app.config.get('REDIS_CERT_DATA')
-    if cert_data and redis_uri.scheme == 'rediss':
+    # SSL support using centralized config
+    cert_path = app.config.get('REDIS_CA_CERT_PATH')
+    if cert_path and redis_uri.scheme == 'rediss':
         import ssl
-        import tempfile
-
         # Create SSL context
         ssl_context = ssl.create_default_context()
         ssl_context.verify_mode = ssl.CERT_REQUIRED
-        ssl_context.check_hostname = True
-
-        # Write cert to temp file
-        with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.pem') as f:
-            f.write(cert_data)
-            ssl_cert_path = f.name
-
-        ssl_context.load_verify_locations(ssl_cert_path)
-
+        ssl_context.check_hostname = app.config.get('REDIS_SSL_CHECK_HOSTNAME', True)
+        ssl_context.load_verify_locations(cert_path)
         # Add SSL to connection pool kwargs
         config['connection_pool_class_kwargs']['ssl'] = ssl_context