[BESU-163] Add inbound and outbound TLS information.

docs/Concepts/TLS.md

@@ -0,0 +1,14 @@
+description: TLS overview
+<!--- END of page meta data -->
+
+# TLS Communication
+
+Hyperledger Besu supports inbound TLS communication (for example from EthSigner
+or curl).
+
+All TLS versions are supported. However, certificates must be PKCS #12 
+formatted.
+
+[Configure client authentication](../HowTo/Configure/Configure-TLS.md#create-known-clients-file) to specify which clients can
+connect to Besu, and use the [command line options](../HowTo/Configure/Configure-TLS.md#start-besu) to specify the 
+certificate locations.

docs/HowTo/Configure/Configure-TLS.md

@@ -0,0 +1,54 @@
+description: Configure TLS
+<!--- END of page meta data -->
+
+# Configure TLS
+
+Hyperledger Besu supports TLS for inbound communication. For example, you can
+configure TLS for communication between EthSigner and Besu.
+
+Use the command line to configure TLS.
+
+Besu only supports password-protected PKSC #12 keystore files.
+
+**Prerequisites**:
+
+* Password-protected PKSC #12 keystore.
+* File containing the keystore password
+
+## Create Known Clients File
+
+Create a file (in this example, `knownClients`) that lists one or more clients
+with permission to connect to Besu. Use the format`<common_name> <hex-string>`
+where `<common_name>` is the Common Name specified in the client certificate,
+and `<hex-string>` is the SHA-256 fingerprint of the client certificate.
+
+Only clients with self-signed certificates must be added to the file.
+
+!!! example
+    ```
+    localhost DF:65:B8:02:08:5E:91:82:0F:91:F5:1C:96:56:92:C4:1A:F6:C6:27:FD:6C:FC:31:F2:BB:90:17:22:59:5B:50
+    ```
+
+You can use `openssl` or `keytool` command to display the fingerprint. For
+example, `keytool -list -v -keystore <keystore> -storetype PKCS12 -storepass <MY_PASSWORD>`.
+
+!!! note
+    Common Names used in the certificates must not be identical.
+
+## Start Besu
+
+```bash
+besu --rpc-http-enabled --rpc-http-tls-enabled --rpc-http-tls-keystore-file=/Users/me/my_node/keystore.pfx --rpc-http-tls-keystore-password-file=/Users/me/my_node/keystorePassword --rpc-http-tls-known-clients-file=/Users/me/my_node/knownClients
+```
+
+The command line:
+
+* Enables the HTTP JSON-RPC service using the [`--rpc-http-enabled`](../../Reference/CLI/CLI-Syntax.md#rpc-http-enabled) option.
+* Enables TLS for the HTTP JSON-RPC service using the [`--rpc-http-tls-enabled`](../../Reference/CLI/CLI-Syntax.md#rpc-http-tls-enabled)
+option.
+* Specifies the keystore using the [`--rpc-http-tls-keystore-file`](../../Reference/CLI/CLI-Syntax.md#rpc-http-tls-keystore-file) option.
+* Specifies the file that contains the password to decrypt the keystore using
+the [`--rpc-http-tls-keystore-password-file`](../../Reference/CLI/CLI-Syntax.md#rpc-http-tls-keystore-password-file) option.
+* Specify the clients that are allowed to connect to Besu using the
+[`--rpc-http-tls-known-clients-file`](../../Reference/CLI/CLI-Syntax.md#rpc-http-tls-known-clients-file) option.
+

docs/Reference/CLI/CLI-Syntax.md

@@ -1517,6 +1517,93 @@ rpc-http-port="3435"
 Specifies HTTP JSON-RPC listening port (TCP).
 The default is 8545. Ports must be [exposed appropriately](../../HowTo/Find-and-Connect/Configuring-Ports.md). 
 
+### rpc-http-tls-enabled
+
+```bash tab="Syntax"
+--rpc-http-tls-enabled
+```
+
+```bash tab="Environement Variable"
+BESU_RPC_HTTP_TLS_ENABLED=true
+```
+
+```bash tab="Configuration File"
+rpc-http-tls-enabled=true
+```
+
+Enable TLS for the JSON-RPC HTTP service. The default is `false`.
+
+[`--rpc-http-enabled`](#rpc-http-enabled) must be enabled.
+
+### rpc-http-tls-keystore-file
+
+```bash tab="Syntax"
+--rpc-http-tls-keystore-file=<FILE>
+```
+
+```bash tab="Command Line"
+--rpc-http-tls-keystore-file=/home/me/me_node/certificate.pfx
+```
+
+```bash tab="Environment Variable"
+BESU_RPC_HTTP_TLS_KEYSTORE_FILE=/home/me/me_node/certificate.pfx
+```
+
+```bash tab="Configuration File"
+rpc-http-tls-keystore-file="/home/me/me_node/certificate.pfx"
+```
+PKCS #12 keystore file. Must be specified if TLS is enabled for the JSON-RPC
+HTTP service.
+
+### rpc-http-tls-keystore-password-file
+
+```bash tab="Syntax"
+--rpc-http-tls-keystore-password-file=<FILE>
+```
+
+```bash tab="Command Line"
+--rpc-http-tls-keystore-password-file=/home/me/me_node/password
+```
+
+```bash tab="Environment Variable"
+BESU_RPC_HTTP_TLS_KEYSTORE_PASSWORD_FILE=/home/me/me_node/password
+```
+
+```bash tab="Configuration File"
+rpc-http-tls-keystore-password-file="/home/me/me_node/password"
+```
+
+Password file used to decrypt the keystore.
+
+### rpc-http-tls-known-clients-file
+
+```bash tab="Syntax"
+--rpc-http-tls-known-clients-file=<FILE>
+```
+
+```bash tab="Command Line"
+--rpc-http-tls-known-clients-file=/home/me/me_node/knownClients
+```
+
+```bash tab="Environment Variable"
+BESU_RPC_HTTP_TLS_KNOWN_CLIENTS_FILE=/home/me/me_node/knownClients
+```
+
+```bash tab="Configuration File"
+rpc-http-tls-known-clients-file="/home/me/me_node/knownClients"
+```
+
+Enables client authentication.
+
+For client certificates not signed by a known root CA this must contain the
+certifcates's Common Name, and SHA-256 fingerprint in the format
+`<CommonName> <hex-string>`.
+
+Client certificates signed by a known CA do not need to be added to the file.
+
+The file contents can be left empty, which indicates only clients with
+certificates signed by known CAs are allowed.
+
 ### rpc-ws-api
 
 ```bash tab="Syntax"

docs/index.md

@@ -20,7 +20,7 @@ Besu supports enterprise features including privacy and permissioning.
 
 Besu includes a [command line interface](Reference/CLI/CLI-Syntax.md) and [JSON-RPC API](HowTo/Interact/APIs/API.md)
 for running, maintaining, debugging, and monitoring nodes in an Ethereum network. You can use the API via RPC
-over HTTP or via WebSockets, and Pub/Sub is supported. The API supports typical Ethereum functionalities such as:
+over HTTP/HTTPS or via WebSockets, and Pub/Sub is supported. The API supports typical Ethereum functionalities such as:
 
 * Ether mining
 * Smart contract development

mkdocs.yml

@@ -67,6 +67,7 @@ nav:
           - Create Besu Genesis File: HowTo/Configure/Genesis-File.md
           - Specify Options in a Configuration File: HowTo/Configure/Using-Configuration-File.md
           - Configure a Free Gas Network: HowTo/Configure/FreeGas.md
+          - Configure TLS: HowTo/Configure/Configure-TLS.md
           - High Availability:
             - Configure High Availability of APIs: HowTo/Configure/Configure-HA/High-Availability.md
             - Sample Load Balancer Configurations: HowTo/Configure/Configure-HA/Sample-Configuration.md
@@ -160,6 +161,7 @@ nav:
           - Vadidating Transactions: Concepts/Transactions/Transaction-Validation.md
         - Monitoring: Concepts/Monitoring.md
         - Events and Logs: Concepts/Events-and-Logs.md
+        - TLS Communication: Concepts/TLS.md
         - Node Keys: Concepts/Node-Keys.md
         - Network vs Node Configuration: Concepts/Network-vs-Node.md
         - Network ID and Chain ID: Concepts/NetworkID-And-ChainID.md