# SSL/TLS Support

Rostrum provides **built-in SSL/TLS support** for all connection types, making it easier to deploy secure Electrum servers without requiring external reverse proxies.

## Built-in SSL/TLS Support

Rostrum supports the following secure protocols out of the box:

- **TCP SSL (ElectrumS)**: Secure TCP connections using TLS
- **WebSocket SSL (WSS)**: Secure WebSocket connections using TLS  
- **HTTPS**: Secure HTTP connections using TLS

## Automatic SSL/TLS Enabling

SSL/TLS endpoints are automatically enabled when SSL certificate and key files are provided except for HTTPS, which needs to be enabled with `--https` flag. Simply specify the certificate files and Rostrum will automatically enable the appropriate SSL/TLS endpoints:

```bash
rostrum --ssl-cert-file=/path/to/certificate.pem --ssl-key-file=/path/to/private-key.pem
```

**Note**: When SSL certificate files are provided, Rostrum automatically enables:
- TCP SSL (ElectrumS) by default
- WebSocket SSL (WSS) by default  
- HTTPS if `--https` is explicitly specified

To disable any of these SSL endpoints, use the corresponding `--no-` flag (e.g., `--no-tcp-ssl`, `--no-websocket-ssl`).

## Getting Started

For detailed setup instructions, including:
- Installing and configuring Certbot
- Obtaining SSL certificates from Let's Encrypt
- Configuring Rostrum with SSL
- Setting up automatic renewal
- Testing your SSL setup
- Troubleshooting common issues

See the **[SSL/TLS Setup Guide](ssl-setup-guide.md)** for comprehensive instructions.

