---
title: "How to Secure the Celery Task Queue with Fernet"
description: "Celery jobs sent through a Redis broker can expose their contents because Redis does not currently support SSL and Heroku add-ons communicate over the public web. The proposed solution encrypts jobs before they travel between dynos and Redis by wrapping Kombu’s default serializers with Fernet symmetric encryption from Cryptography. The open-source kombu-fernet-serializers library supplies these encrypted serializers through Setuptools entry points; setup requires adding the package, storing a Fernet key in KOMBU_FERNET_KEY, and configuring Celery to use fernet_json with MIMETYPE in CELERY_ACCEPT_CONTENT. The example creates a Celery app with REDIS_URL as its broker and uses the serializer settings, retaining Redis’s straightforward configuration while addressing sensitive information in transit."
---

# How to Secure the Celery Task Queue with Fernet

[Heroku](https://yomu.fyi/company/heroku) · David Gouldin · Sep 15, 2014

**Type:** Problem & solution

## Summary

Celery jobs sent through a Redis broker can expose their contents because Redis does not currently support SSL and Heroku add-ons communicate over the public web. The proposed solution encrypts jobs before they travel between dynos and Redis by wrapping Kombu’s default serializers with Fernet symmetric encryption from Cryptography. The open-source kombu-fernet-serializers library supplies these encrypted serializers through Setuptools entry points; setup requires adding the package, storing a Fernet key in KOMBU\_FERNET\_KEY, and configuring Celery to use fernet\_json with MIMETYPE in CELERY\_ACCEPT\_CONTENT. The example creates a Celery app with REDIS\_URL as its broker and uses the serializer settings, retaining Redis’s straightforward configuration while addressing sensitive information in transit.

## Context

Celery jobs sent through Redis can travel unencrypted between dynos and Redis because Redis does not currently support SSL, while Heroku add-ons communicate over the public web.

## Approach / What changed

The kombu-fernet-serializers library wraps Kombu’s default serializers with Fernet encryption from Cryptography. Users add the package, store the Fernet key in KOMBU\_FERNET\_KEY, and configure Celery with fernet\_json and the supplied MIMETYPE.

## Takeaways

- Redis does not currently support SSL, so Celery job contents sent through Heroku add-ons can travel unencrypted between dynos and Redis.
- Kombu custom serializers control how Celery jobs become byte strings for the broker and how they are converted back, enabling Fernet encryption around the default serializers.
- The example configures CELERY\_TASK\_SERIALIZER='fernet\_json' and includes MIMETYPE in CELERY\_ACCEPT\_CONTENT while using REDIS\_URL as the broker.

**Tags:** [Python](https://yomu.fyi/topic/python), [Redis](https://yomu.fyi/topic/redis), [Security](https://yomu.fyi/topic/security)

- Source: [Heroku](https://www.heroku.com/blog/securing-celery)
- Source URL: https://www.heroku.com/blog/securing-celery
- Ingested by Yomu: 2026-09-09T14:23:22.638Z

[Read original post](https://www.heroku.com/blog/securing-celery)