<p>Bitcoin Core's RPC interface only supports HTTP, not HTTPS.</p>
<p>The reasoning is that the RPC interface is intended for local access by other applications, not over the internet or network access in general. Doing so allows reducing the complexity and attack surface a built-in SSL implementation would bring.</p>
<p>If you <em>really</em> need network access for RPC, use a VPN, or e.g. <code>stunnel</code> to wrap it in SSL.</p>

CC BY-SA 4.0
2022-05-16T22:16:39.853Z
2022-05-16T22:16:39.853Z
Pieter Wuille
<p>I'm confused with the examples of contacting bitcoin-cli as the examples always show sending user name:pass to http does this expose the name:pass?</p>
<p>This command: (I modified the help example from bitcoin-cli help)</p>
<blockquote>
<p>curl --user '<strong>rpcuser:rpcpassword</strong>' <strong>--cacert /home/ssl/mycert.pem</strong> --data-binary '{&quot;jsonrpc&quot;: &quot;1.0&quot;, &quot;id&quot;: &quot;curltest&quot;, &quot;method&quot;: &quot;signrawtransactionwithkey&quot;, &quot;params&quot;: [&quot;myhex&quot;, &quot;[&quot;key1&quot;,&quot;key2&quot;]&quot;]}' -H 'content-type: text/plain;' <strong>https</strong>://<strong>777.77.7.7</strong>:8332/</p>
</blockquote>
<p>produces the error:</p>
<p><code>curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number</code></p>
<p>But if I replace the https with http it works. Shouldn't bitcoin-cli refuse to work with http and allow https only?</p>

<json-rpc><rpc-error-4>
Will remote RPC under http expose the rpcusername and rpcpassword?
Ben Muircroft
# Will remote RPC under http expose the rpcusername and rpcpassword?

(Asked by: username_0 on 2022-05-16)

I'm confused with the examples of contacting bitcoin-cli as the examples always show sending user name:pass to http does this expose the name:pass?

This command: (I modified the help example from bitcoin-cli help)

> curl --user '**rpcuser:rpcpassword**' **--cacert /home/ssl/mycert.pem** --data-binary '{"jsonrpc": "1.0", "id": "curltest", "method": "signrawtransactionwithkey", "params": ["myhex", "["key1","key2"]"]}' -H 'content-type: text/plain;' **https**://**777.77.7.7**:8332/

produces the error:

`curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number`

But if I replace the https with http it works. Shouldn't bitcoin-cli refuse to work with http and allow https only?

**Tags:** json-rpc, rpc-error-4


---

## 1 answers

### Answer by username_1 on 2022-05-16. Score: 2

Bitcoin Core's RPC interface only supports HTTP, not HTTPS.

The reasoning is that the RPC interface is intended for local access by other applications, not over the internet or network access in general. Doing so allows reducing the complexity and attack surface a built-in SSL implementation would bring.

If you *really* need network access for RPC, use a VPN, or e.g. `stunnel` to wrap it in SSL.


---

