How do you enable SSL/TLS in CouchDB and what configuration is required?

CouchDB has a built-in HTTPS listener that can be enabled by adding a [ssl] section to the CouchDB configuration (local.ini or local.d/*.ini). No reverse proxy is required for basic TLS, though using nginx in front is common in production for certificate management and connection pooling.

[ssl]
enable = true
port = 6984
cert_file = /etc/couchdb/ssl/couchdb.pem
key_file  = /etc/couchdb/ssl/privkey.pem
# Optional: require client certificates
cacert_file = /etc/couchdb/ssl/cacert.pem
verify_ssl_certificates = false

# Restrict to strong cipher suites
ssl_options = [{secure_renegotiate, true}]

Configuration steps:

1. Generate or obtain a certificate and private key (Let's Encrypt, self-signed, or a commercial CA).
2. Place the PEM files in a directory readable by the CouchDB process (but not world-readable).
3. Add the [ssl] section to local.ini. CouchDB listens on port 6984 for HTTPS by default (the plaintext port 5984 continues to work unless you disable it).
4. Restart CouchDB and verify: curl https://localhost:6984/
5. In production, disable the plaintext listener by setting [chttpd] bind_address = 127.0.0.1 and routing all external traffic through the HTTPS port or a TLS-terminating reverse proxy.

For clustered setups, TLS should be configured both for client-facing traffic and for node-to-node replication traffic. The inter-node Erlang distribution channel can be secured using Erlang TLS distribution, though this requires additional Erlang configuration beyond the CouchDB config file.