Skip to main content

Configure P2P TLS

You can configure TLS to secure the P2P communication between nodes by ensuring only authorized nodes can communicate with each other. Use certificates issued by a trusted authority to connect authorized nodes in the network.

caution

P2P TLS is an early access feature, and functionality and options may be updated between releases.

Besu supports PKCS11, PKCS12, and JKS keystore and truststore types for P2P TLS.

Configure P2P TLS​

Prerequisites:

  • A configured network. For example, see steps 1 to 5 in the QBFT tutorial.
  • Each node requires a keystore that contains the node's certificate and key.
  • A truststore containing all the trusted certificates for the network.

Start Besu and include the following command line options on the required nodes:

besu --Xp2p-tls-enabled=true \
--Xp2p-tls-keystore-type="PKCS12" \
--Xp2p-tls-keystore-file="keystore" \
--Xp2p-tls-keystore-password-file="keystore.password" \
--Xp2p-tls-crl-file="crl2.pem" \
--Xp2p-tls-truststore-type="JKS" \
--Xp2p-tls-truststore-file="truststore.jks" \
--Xp2p-tls-truststore-password-file="truststore_password.txt"

In the command line:

Command line options​

Xp2p-tls-crl-file​

Syntax

--Xp2p-tls-crl-file=<FILE>

Example

--Xp2p-tls-crl-file=/home/cert/cert.crl.pem

Environment variable

BESU_XP2P_TLS_CRL_FILE=/home/cert/cert.crl.pem

Path to the optional certificate revocation list (CRL) file.

Xp2p-tls-enabled​

Syntax

--Xp2p-tls-enabled[=<true|false>]

Example

--Xp2p-tls-enabled=true

Environment variable

BESU_XP2P_TLS_ENABLED=true

Enable TLS for P2P communication. The default is false.

Xp2p-tls-keystore-file​

Syntax

--Xp2p-tls-keystore-file=<FILE>

Example

--Xp2p-tls-keystore-file=/home/cert/keystore.jks

Environment variable

BESU_XP2P_TLS_KEYSTORE_FILE=/home/cert/keystore.jks

Keystore file containing the key and certificate to allow TLS for P2P communication.

Xp2p-tls-keystore-password-file​

Syntax

--Xp2p-tls-keystore-password-file=<FILE>

Example

--Xp2p-tls-keystore-password-file=/home/cert/password.txt

Environment variable

BESU_XP2P_TLS_KEYSTORE_PASSWORD_FILE=/home/cert/password.txt

Text file containing the password to unlock the keystore file.

Xp2p-tls-keystore-type​

Syntax

--Xp2p-tls-keystore-type=<TYPE>

Example

--Xp2p-tls-keystore-type=JKS

Environment variable

BESU_XP2P_TLS_KEYSTORE_TYPE=JKS

Keystore type that allows TLS for P2P communication. Valid options are JKS, PKCS11, and PKCS12. The default is JKS.

Xp2p-tls-truststore-file​

Syntax

--Xp2p-tls-truststore-file=<FILE>

Example

--Xp2p-tls-truststore-file=/home/cert/truststore.jks

Environment variable

BESU_XP2P_TLS_TRUSTSTORE_FILE=/home/cert/truststore.jks

Truststore containing the trusted certificates that allows TLS for P2P communication.

Xp2p-tls-truststore-password-file​

Syntax

--Xp2p-tls-truststore-password-file=<FILE>

Example

--Xp2p-tls-truststore-password-file=/home/cert/password.txt

Environment variable

BESU_XP2P_TLS_TRUSTSTORE_PASSWORD_FILE=/home/cert/password.txt

Text file containing the password to unlock the truststore file.

Xp2p-tls-truststore-type​

Syntax

--Xp2p-tls-truststore-type=<TYPE>

Example

--Xp2p-tls-truststore-type=JKS

Environment variable

BESU_XP2P_TLS_TRUSTSTORE_TYPE=JKS

Truststore type. Valid options are JKS, PKCS11, and PKCS12. The default is JKS.