<p>Here is how you get RPC SSL to work...</p>

<p>rpcssl=1</p>

<p>Now here is the secret...</p>

<p>Your server.key and server.cert must be placed inside your /bitcoin/testnet folder, or in my case /bitcoin/testnet3 folder.</p>

<p>In my case I have a server.pem file instead of server.cert.  A chained security certificate file.</p>

CC BY-SA 3.0
2015-05-30T11:48:09.647Z
While this may be helpful information, this doesn't seem to address the question "How secure is calling bitcoind's JSON-RPC?".
Murch
CC BY-SA 3.0
2015-05-28T08:18:20.187Z
2015-05-28T08:18:20.187Z
buycanna.io
<p>Yes, they can. Unless you enable RPC-over-SSL, the username and password are send Base64 encoded as a header in the HTTP request, which is easily decoded.</p>

CC BY-SA 3.0
2012-02-12T05:13:30.590Z
https://en.bitcoin.it/wiki/Enabling_SSL_on_original_client_daemon provides a guide to setting up RPC-over-SSL but I couldn't get it to work for me.  I was trying to run a "bitcoin-qt -server" and access it using RPC-over-SSL from another host on the LAN.  I could access it from the host it was running on, but not remotely.  I added a suitable "-rpcallowip=" flag, and -rpcssl=1, but was probably doing something wrong.
Chris Moore
CC BY-SA 3.0
2012-01-19T22:28:52.457Z
2012-01-19T22:28:52.457Z
David Schwartz
<p>How secure is <a href="https://en.bitcoin.it/wiki/API_reference_%28JSON-RPC%29#Python">calling bitcoind through a JSON-RPC</a>? For example, if I run it on one of my computers, and try calling it from another computer (provided neither of them are compromised), can someone intercept my communication and gain my RPC username and password? </p>

<security><wallet><bitcoind><json-rpc>
How secure is calling bitcoind JSON-RPC?
ThePiachu
# How secure is calling bitcoind JSON-RPC?

(Asked by: username_0 on 2012-01-19)

How secure is [calling bitcoind through a JSON-RPC](https://en.bitcoin.it/wiki/API_reference_%28JSON-RPC%29#Python)? For example, if I run it on one of my computers, and try calling it from another computer (provided neither of them are compromised), can someone intercept my communication and gain my RPC username and password?

**Tags:** security, wallet, bitcoind, json-rpc


---

## 2 answers

### Answer by username_3 on 2012-01-19. Score: 10 | Accepted answer

Yes, they can. Unless you enable RPC-over-SSL, the username and password are send Base64 encoded as a header in the HTTP request, which is easily decoded.

> **Comments:**
> **username_4**: https://en.bitcoin.it/wiki/Enabling_SSL_on_original_client_daemon provides a guide to setting up RPC-over-SSL but I couldn't get it to work for me.  I was trying to run a "bitcoin-qt -server" and access it using RPC-over-SSL from another host on the LAN.  I could access it from the host it was running on, but not remotely.  I added a suitable "-rpcallowip=" flag, and -rpcssl=1, but was probably doing something wrong.  

---

### Answer by username_1 on 2015-05-28. Score: 4

Here is how you get RPC SSL to work...

rpcssl=1

Now here is the secret...

Your server.key and server.cert must be placed inside your /bitcoin/testnet folder, or in my case /bitcoin/testnet3 folder.

In my case I have a server.pem file instead of server.cert. A chained security certificate file.

> **Comments:**
> **username_2**: While this may be helpful information, this doesn't seem to address the question "How secure is calling bitcoind's JSON-RPC?".  

---

