How do you enable SSL/TLS in CouchDB and what configuration is required?

CouchDB has a built-in HTTPS listener that can be enabled by adding a [ssl] section to the CouchDB configuration (local.ini or local.d/*.ini). No reverse proxy is required for basic TLS, though using nginx in front is common in production for certificate management and connection pooling.

[ssl]
enable = true
port = 6984
cert_file = /etc/couchdb/ssl/couchdb.pem
key_file  = /etc/couchdb/ssl/privkey.pem
# Optional: require client certificates
cacert_file = /etc/couchdb/ssl/cacert.pem
verify_ssl_certificates = false

# Restrict to strong cipher suites
ssl_options = [{secure_renegotiate, true}]

Configuration steps:

1. Generate or obtain a certificate and private key (Let's Encrypt, self-signed, or a commercial CA).
2. Place the PEM files in a directory readable by the CouchDB process (but not world-readable).
3. Add the [ssl] section to local.ini. CouchDB listens on port 6984 for HTTPS by default (the plaintext port 5984 continues to work unless you disable it).
4. Restart CouchDB and verify: curl https://localhost:6984/
5. In production, disable the plaintext listener by setting [chttpd] bind_address = 127.0.0.1 and routing all external traffic through the HTTPS port or a TLS-terminating reverse proxy.

For clustered setups, TLS should be configured both for client-facing traffic and for node-to-node replication traffic. The inter-node Erlang distribution channel can be secured using Erlang TLS distribution, though this requires additional Erlang configuration beyond the CouchDB config file.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.