How to do SSL termination

[snoby]

So digging around I never found a full answer on how to do ssl termination with miningcore.

First thing i tried was getting a cert from letsencrypt then turning that into a pfx file. No matter what I did I couldn't get MC to accept the cert. With or without a passphrase. So I decided to setup an nginx reverse proxy to terminate the ssl.

The next thing I did was setup certbot with the manual command to get a wildcard cert. I ran cert bot through a docker container and the certificate was stored in a docker volume:

!/bin/bash
set -x

CONTAINER_NAME=wild_certbot
CONT_NAME=certbot/certbot
docker stop "$CONTAINER_NAME" && docker rm "$CONTAINER_NAME"
docker pull "$CONT_NAME"

docker run                                     \
  -it --name="$CONTAINER_NAME"                 \
  --rm                                         \
  --sysctl net.ipv6.conf.all.disable_ipv6=1    \
  -v certbot_certs:/etc/letsencrypt            \
  -v certbot_var:/var/lib/letsencypt           \
  -e PUID="$UID"                               \
  -e PGID="$UID"                               \
  -e TZ=EST5EDT                                \
  "$CONT_NAME" certonly --manual --preferred-challenges=dns --email [email protected] --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d example.com -d *.example.com

This runs and asks you to do some interactive stuff, you can google what you have to do here.

Next I setup an nginx container and config file that mounts the certbot_certs volume
nginx config

Where MC lives at ip address 10.0.0.225 and the stratum port is port 8880

worker_processes 4;

events {
  worker_connections 4096;
}


stream {
  server {
    listen 7000 ssl;
    proxy_pass 10.0.0.225:8880;
    # stratum doesn't support proxy_protocol
    # proxy_protocol on;

   ssl_certificate      /certs/live/example.com/cert.pem;
   ssl_certificate_key  /certs/live/example.com/privkey.pem;
   ssl_handshake_timeout 10s;
   ssl_session_cache shared:SSL:1m;
   ssl_session_timeout 1h;
  }
}

The command to run the nginx reverse proxy is below, I build the nginx.conf file into the container, I'm just being lazy I'm sure I can also just bind mount it.

#!/bin/bash
set -x

CONTAINER_NAME=stratum_reverse
CONT_NAME=stratumssl:v1
docker stop "$CONTAINER_NAME" && docker rm "$CONTAINER_NAME"
#docker pull "$CONT_NAME"

docker run                                     \
  -d --name="$CONTAINER_NAME"                 \
  --sysctl net.ipv6.conf.all.disable_ipv6=1    \
  -v certbot_certs:/certs                       \
  -e PUID="$UID"                               \
  -e PGID="$UID"                               \
  -p 7000:7000                                 \
  -e TZ=EST5EDT                                \
  "$CONT_NAME"

And finally the stratum definition in MC where '10.0.0.34" is the ip address of the nginx container that is doing the reverse proxy ssl termination.

       "8880": {
          "name": "LOWDIFF POOL GPU",
          "listenAddress": "0.0.0.0",
	  "tcpProxyProtocol": {
              "enable": true,
	      "mandatory": true,
	      "proxyAddresses": ["::ffff:10.0.0.34"]
	  },
          "difficulty": 2,
          "varDiff": {
            "minDiff": 4,
            "maxDiff": null,
            "targetTime": 15,
            "retargetTime": 90,
            "maxDelta": 500,
            "variancePercent": 30
          }
        },

This did add 1 to 2 ms to the latency of the miner.

Hope this helps!

[oliverw]

You realize that 99% of the miners do not validate the server cert by default? For mining you can get away with a basic self-signed certificate generated by OpenSSL. 😁

[snoby]

I did not realize that, how funny! As an SRE in real life, it's real certs or hell fire rains down upon you! lol

[oliverw]

I did not realize that, how funny! As an SRE in real life, it's real certs or hell fire rains down upon you! lol

I also had it working with a real certificate a while back which I generated from the .key and .crt files using openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt

[snoby]

I did not realize that, how funny! As an SRE in real life, it's real certs or hell fire rains down upon you! lol

I also had it working with a real certificate a while back which I generated from the .key and .crt files using openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt

I tried that with the letsencrypt certificates, along with the full chain and verified the resultant pfx file, but could never get the .net framework in MC to accept the cert... whenever any data came in there was always the frame error.
That's fine. I may try the self signed cert just for fun because operationally that's easier.
thanks!

[MiningCryptoLive]

@snoby . You can also use the certificates created by letsencrypt. I have it running on my pool. Took a little while to figure out why it kept giving errors. You have to keep them in the directory made by letsencrypt. If you move the certificates you will get errors.