AutoTLS implementation #5187
Open
AutoTLS implementation #5187
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sbackend123
approved these changes
Aug 21, 2025
4 tasks
4 tasks
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
gacevicljubisa
approved these changes
Nov 24, 2025
…simplification" This reverts commit e49f261.
This reverts commit 341fa9e.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Checklist
Description
This pull request introduces an AutoTLS implementation for the Bee node. The primary motivation for this feature is to support the In-Browser project, which requires secure communication channels for clients.
Modern web browsers strictly enforce secure contexts, meaning they can only connect to endpoints using secure protocols like HTTPS or Secure WebSockets (wss://). AutoTLS automates the process of obtaining, managing, and renewing valid TLS certificates from a Certificate Authority (like Let's Encrypt).
By implementing AutoTLS, Bee nodes can now accept wss:// connections directly, enabling browsers to interact with the Bee network securely and seamlessly.
Implementation Details
The implementation is based on the approach outlined in the official libp2p blog post on AutoTLS and follows the patterns from the go-libp2p AutoTLS example.
Testing & Validation
The functionality was manually tested by running a Bee node (built with the flag above) and attempting to connect to it using wscat over a secure websocket.
Test Command:
wscat --no-check -c wss://<node-public-ip>.<peer-id>.libp2p.direct:5500Result:
A successful connection was established, and the node responded with the multistream header, confirming the wss listener is active and secured with a valid TLS certificate:
Related Issue (Optional)
#5171