11

The Wiki contains a page that simply states:

JSON-RPC over SSL is strongly discouraged

Why?

I found a method for enabling JSON_RPC over SSL here. The post mentions nothing about JSON-RPC over SSL being strongly discouraged. What risks do I run by using it?

9

The RPC interface isn't designed to be used in any scenario which would require SSL, which would be access over the internet or other untrusted networks. It doesn't have the necessary denial of service protections or review to make it safe for use this way, and so letting potentially malicious clients connect to it would be incredibly unwise. If you need to talk to a remote bitcoind instance you are better off tunneling with SSH or stunnel which will provide a secure, authenticated path without exposing the socket any further than localhost.

As of 2017, support for RPC SSL has been completely removed to support the continued move away from reliance on OpenSSL in the daemon (unfortunately BIP70 mandates its inclusion for the GUI client).

As of 2019, all reliance on OpenSSL has been successfully removed from bitcoind.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.