Why do public nodes use http instead of https?

Question

All public nodes are configured in HTTP. Why aren't they using HTTPS? I can figure out that it's easier to setup and that a TCP connection is also a little faster.

But is there any other reason to use HTTP?

Is it possible to setup a node with HTTPS?

Answer 1

Why are they not using HTTPS?

As far as I know, IRI only supports HTTP natively, however HTTPS is possible if you put something in front of it. Why most public nodes are not currently using it is probably simply the fact that it is not required, and involves some additional configuration. Like you, I believe they should be.

Is it possible?

Yes. My node node has it's API endpoint exposed behind Apache so that I can add an SSL cert and log traffic.

Using apache, you can do this simply with a ProxyPass.

A VirtualHost for http:80 will send a redirect to https:443

<VirtualHost *:80>
        RewriteCond             %{HTTP_HOST} !https://iota\.example\.com       [NC]
        RewriteRule             ^ https://iota.example.com                     [R=301,L]
</VirtualHost>

Then https:443 will serve the API by proxying it to IRI, having had the SSL connection already terminated.

<VirtualHost *:443>

        # Proxy to IRI
        ProxyPass               /            http://127.0.0.1:14265/
        ProxyPassReverse        /            http://127.0.0.1:14265/

        # Certificates
        SSLEngine on
        SSLCertificateFile      /etc/ssl/certs/iota.example.com.crt
        SSLCertificateKeyFile   /etc/ssl/certs/iota.example.com.key
        SSLCACertificateFile    /etc/ssl/certs/iota.example.com.ca-bundle
</VirtualHost>

Now I can use https for all my clients, including the Light Wallet.

$ curl https://iota.example.com \
  -X POST \
  -H 'Content-Type: application/json' \
  -H 'X-IOTA-API-Version: 1' \
  -d '{"command": "getNodeInfo"}'

> {"appName":"IRI","appVersion":"1.4.1.2","jreAvailableProcessors":2 ...