13

The Wiki contains a page that simply states:

JSON-RPC over SSL is strongly discouraged

Why?

I found a method for enabling JSON_RPC over SSL here. The post mentions nothing about JSON-RPC over SSL being strongly discouraged. What risks do I run by using it?

Improve this question
1
  • Note to other readers: This question is about the use of a command interface for Bitcoin software, and does not really have anything to do wtih JSON-RPC.
    – Zero3
    Commented Feb 23, 2021 at 11:12

1 Answer 1

Reset to default
11

The RPC interface isn't designed to be used in any scenario which would require SSL, which would be access over the internet or other untrusted networks. It doesn't have the necessary denial of service protections or review to make it safe for use this way, and so letting potentially malicious clients connect to it would be incredibly unwise. If you need to talk to a remote bitcoind instance you are better off tunneling with SSH or stunnel which will provide a secure, authenticated path without exposing the socket any further than localhost.

As of 2017, support for RPC SSL has been completely removed to support the continued move away from reliance on OpenSSL in the daemon (unfortunately BIP70 mandates its inclusion for the GUI client).

As of 2019, all reliance on OpenSSL has been successfully removed from bitcoind.

Improve this answer
6

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.