diff --git a/services/document-updater/config/settings.defaults.coffee b/services/document-updater/config/settings.defaults.coffee
index f890eb0f4a..0965c5bd3d 100755
--- a/services/document-updater/config/settings.defaults.coffee
+++ b/services/document-updater/config/settings.defaults.coffee
@@ -1,6 +1,7 @@
 Path = require('path')
 http = require('http')
 http.globalAgent.maxSockets = 300
+fs = require('fs')
 
 module.exports =
 	internal:
@@ -44,6 +45,12 @@ module.exports =
 			key_schema:
 				projectHistoryOps: ({project_id}) -> "ProjectHistory:Ops:{#{project_id}}"
 				projectHistoryFirstOpTimestamp: ({project_id}) -> "ProjectHistory:FirstOpTimestamp:{#{project_id}}"
+			tls: if process.env['REDIS_CA_CERT'] && process.env['REDIS_CLIENT_CERT'] && process.env['REDIS_CLIENT_KEY']
+				ca: fs.readFileSync(process.env['REDIS_CA_CERT']),
+				cert: fs.readFileSync(
+					process.env['REDIS_CLIENT_CERT']
+				),
+				key: fs.readFileSync(process.env['REDIS_CLIENT_KEY'])
 
 		new_project_history:
 			port: process.env["NEW_HISTORY_REDIS_PORT"] or "6379"
@@ -54,6 +61,12 @@ module.exports =
 				projectHistoryFirstOpTimestamp: ({project_id}) -> "ProjectHistory:FirstOpTimestamp:{#{project_id}}"
 				projectHistoryMigrationKey: ({project_id}) -> "ProjectHistory:MigrationKey:{#{project_id}}"
 			migration_phase: "prepare"
+			tls: if process.env['NEW_HISTORY_REDIS_CA_CERT'] && process.env['NEW_HISTORY_REDIS_CLIENT_CERT'] && process.env['NEW_HISTORY_REDIS_CLIENT_KEY']
+				ca: fs.readFileSync(process.env['NEW_HISTORY_REDIS_CA_CERT']),
+				cert: fs.readFileSync(
+					process.env['NEW_HISTORY_REDIS_CLIENT_CERT']
+				),
+				key: fs.readFileSync(process.env['NEW_HISTORY_REDIS_CLIENT_KEY'])
 			redisOptions:
 				keepAlive: 100