# SSL/TLS Support
Rostrum provides **built-in SSL/TLS support** for all connection types, making it easier to deploy secure Electrum servers without requiring external reverse proxies.
## Built-in SSL/TLS Support
Rostrum supports the following secure protocols out of the box:
- **TCP SSL (ElectrumS)**: Secure TCP connections using TLS
- **WebSocket SSL (WSS)**: Secure WebSocket connections using TLS
- **HTTPS**: Secure HTTP connections using TLS
## Automatic SSL/TLS Enabling
SSL/TLS endpoints are automatically enabled when SSL certificate and key files are provided except for HTTPS, which needs to be enabled with `--https` flag. Simply specify the certificate files and Rostrum will automatically enable the appropriate SSL/TLS endpoints:
```bash
rostrum --ssl-cert-file=/path/to/certificate.pem --ssl-key-file=/path/to/private-key.pem
```
**Note**: When SSL certificate files are provided, Rostrum automatically enables:
- TCP SSL (ElectrumS) by default
- WebSocket SSL (WSS) by default
- HTTPS if `--https` is explicitly specified
To disable any of these SSL endpoints, use the corresponding `--no-` flag (e.g., `--no-tcp-ssl`, `--no-websocket-ssl`).
## Getting Started
For detailed setup instructions, including:
- Installing and configuring Certbot
- Obtaining SSL certificates from Let's Encrypt
- Configuring Rostrum with SSL
- Setting up automatic renewal
- Testing your SSL setup
- Troubleshooting common issues
See the **[SSL/TLS Setup Guide](ssl-setup-guide.md)** for comprehensive instructions.