port 0
tls-port 6379
tls-cert-file "<path_to_file>"
tls-key-file "<path_to_file>"
tls-ca-cert-file "<path_to_file>"
tls-auth-clients no
tls-replication yes

port 0
tls-port 26379
tls-cert-file "<path_to_file>"
tls-key-file "<path_to_file>"
tls-ca-cert-file "<path_to_file>"
tls-auth-clients no
tls-replication yes

...
[celery]
broker_url = redis://<username>:<password>@<host1>:6379;redis://<username>:<password>@<host2>:6379;redis://<username>:<password>@<host3>:6379
ssl_active = True
ssl_key = <path_to_file>
ssl_cert = <path_to_file>
ssl_cacert = <path_to_file>

broker_url = sentinel://<username>:<password>@<rhost_1>:26379;sentinel://<username>:<password>@<rhost_2>:26379;sentinel://<username>:<password>@<host_3>:26379

try:
    if celery_ssl_active:
        if 'amqp://' in broker_url:
            broker_use_ssl = {
                'keyfile': conf.get('celery', 'SSL_KEY'),
                'certfile': conf.get('celery', 'SSL_CERT'),
                'ca_certs': conf.get('celery', 'SSL_CACERT'),
                'cert_reqs': ssl.CERT_REQUIRED,
            }
        elif 'redis://' in broker_url:
            broker_use_ssl = {
                'ssl_keyfile': conf.get('celery', 'SSL_KEY'),
                'ssl_certfile': conf.get('celery', 'SSL_CERT'),
                'ssl_ca_certs': conf.get('celery', 'SSL_CACERT'),
                'ssl_cert_reqs': ssl.CERT_REQUIRED,
            }
        elif 'sentinel://' in broker_url:
            broker_use_ssl = {
                'ssl_keyfile': conf.get('celery', 'SSL_KEY'),
                'ssl_certfile': conf.get('celery', 'SSL_CERT'),
                'ssl_ca_certs': conf.get('celery', 'SSL_CACERT'),
                'ssl_cert_reqs': ssl.CERT_REQUIRED,
            }
        else:
            raise AirflowException(
                'The broker you configured does not support SSL_ACTIVE to be True. '
                'Please use RabbitMQ or Redis if you would like to use SSL for broker.'
            )