SSL/TLS for incoming connections

Automatic configuration

Since v5.10.0 automatic configuration is very easy, proxy will generate TLS certificate and private key. Files (cert.pem and cert_key.pem) will be stored in current working directory or data directory (--data-dir). Once files generated TLS is ready to use, no additional configuration required, you can skip the remaining article, unless you need custom configuration. To disable automatic TLS configuration, use global config option "tls": false, or manually configure it.

Certificate

Best option is obtain trusted certificate from Let's Encrypt . If it is not possible you can use a self-signed certificate, created by yourself or generated by the proxy.

Bind

Example bind configuration:

"bind": [
    {
        "host": "0.0.0.0",
        "port": 443,
        "tls": true
    }
],

Command line equivalent is --tls-bind 0.0.0.0:443.

Since v5.10.0 meaning of tls option changed:

• false TLS autodetection, was disable TLS, default if not specified.
• true always use TLS.

Advanced TLS options

Example global tls configuration:

"tls": {
    "enabled": true,
    "cert": "/etc/letsencrypt/live/donate.ssl.xmrig.com/fullchain.pem",
    "cert_key": "/etc/letsencrypt/live/donate.ssl.xmrig.com/privkey.pem",
    "dhparam": "dhparam.pem",
    "protocols": null,
    "ciphers": null,
    "ciphersuites": null
},

Command line equivalent is --tls-cert /etc/letsencrypt/live/donate.ssl.xmrig.com/fullchain.pem --tls-cert-key /etc/letsencrypt/live/donate.ssl.xmrig.com/privkey.pem --tls-dhparam dhparam.pem.

Options cert and cert_key is required, you must property configure it to use TLS, dhparam is optional, but recommended to use for enhanced security. All other options for advanced usage only, usually don't need change it.

Options list