We can enable TLS on the RPC port with the --rpc-tls=crt,key option when running the tezos-node, but is it possible in any way to authenticate clients that request data from the RPC? (beyond layer3/4 firewalling ACLs) Is is possible to utilize 2-way TLS client+server authentication?

1 Answer 1


This is currently not supported. You can use an nginx proxy to secure it with HTTP Basic Authentication with the following configuration that uses a https connection on standard port:

server {
  listen 443 ssl;
  server_name tezosz-rpc.yourdomain.com;
  include letsencrypt_ssl.conf;
  ssl_certificate /fullchain.cer;
  ssl_certificate_key /tezosz-rpc.yourdomain.com.key;
  ssl_trusted_certificate /tezosz-rpc.yourdomain.com/ca.cer;
  auth_basic              "Restricted Access for tezos RPC interface over https";
  auth_basic_user_file    /usr/local/etc/nginx/htpasswd;
  location / {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_pass http://192.168.X.Y:8732;
  • This is what I do. It works well.
    – Svante
    Mar 20, 2019 at 13:06
  • Any benefits of using nginx over stunnel?
    – Bo Byrd
    Mar 21, 2019 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.