7

We can enable TLS on the RPC port with the --rpc-tls=crt,key option when running the tezos-node, but is it possible in any way to authenticate clients that request data from the RPC? (beyond layer3/4 firewalling ACLs) Is is possible to utilize 2-way TLS client+server authentication?

5

This is currently not supported. You can use an nginx proxy to secure it with HTTP Basic Authentication with the following configuration that uses a https connection on standard port:

server {
  listen 443 ssl;
  server_name tezosz-rpc.yourdomain.com;
  include letsencrypt_ssl.conf;
  ssl_certificate /fullchain.cer;
  ssl_certificate_key /tezosz-rpc.yourdomain.com.key;
  ssl_trusted_certificate /tezosz-rpc.yourdomain.com/ca.cer;
  auth_basic              "Restricted Access for tezos RPC interface over https";
  auth_basic_user_file    /usr/local/etc/nginx/htpasswd;
  location / {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_pass http://192.168.X.Y:8732;
  }
}
| improve this answer | |
  • This is what I do. It works well. – Svante Mar 20 '19 at 13:06
  • Any benefits of using nginx over stunnel? – Bo Byrd Mar 21 '19 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.