is it possible for tezos-node RPC to authenticate clients with SSL?

Question

We can enable TLS on the RPC port with the --rpc-tls=crt,key option when running the tezos-node, but is it possible in any way to authenticate clients that request data from the RPC? (beyond layer3/4 firewalling ACLs) Is is possible to utilize 2-way TLS client+server authentication?

Answer 1

This is currently not supported. You can use an nginx proxy to secure it with HTTP Basic Authentication with the following configuration that uses a https connection on standard port:

server {
  listen 443 ssl;
  server_name tezosz-rpc.yourdomain.com;
  include letsencrypt_ssl.conf;
  ssl_certificate /fullchain.cer;
  ssl_certificate_key /tezosz-rpc.yourdomain.com.key;
  ssl_trusted_certificate /tezosz-rpc.yourdomain.com/ca.cer;
  auth_basic              "Restricted Access for tezos RPC interface over https";
  auth_basic_user_file    /usr/local/etc/nginx/htpasswd;
  location / {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_pass http://192.168.X.Y:8732;
  }
}