We can enable TLS on the RPC port with the --rpc-tls=crt,key
option when running the tezos-node
, but is it possible in any way to authenticate clients that request data from the RPC? (beyond layer3/4 firewalling ACLs) Is is possible to utilize 2-way TLS client+server authentication?
This is currently not supported. You can use an nginx proxy to secure it with HTTP Basic Authentication with the following configuration that uses a https connection on standard port:
server {
listen 443 ssl;
server_name tezosz-rpc.yourdomain.com;
include letsencrypt_ssl.conf;
ssl_certificate /fullchain.cer;
ssl_certificate_key /tezosz-rpc.yourdomain.com.key;
ssl_trusted_certificate /tezosz-rpc.yourdomain.com/ca.cer;
auth_basic "Restricted Access for tezos RPC interface over https";
auth_basic_user_file /usr/local/etc/nginx/htpasswd;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_pass http://192.168.X.Y:8732;
}
}