How do I use TLS or SSL with XMRig?

You can enable TLS in XMRig by choosing your mining pool’s TLS-enabled port and adding --tls to your command, or setting "tls": true in your configuration file. TLS encrypts the connection between your miner and the pool. People sometimes call this “SSL,” but SSL is the older, outdated technology.

Get the right pool address and port

Your mining pool is the service that combines your mining work with other miners’ work and shares rewards. Before changing XMRig, check the pool’s instructions for its TLS server address and port.

A port is a numbered connection point on a server. Pools often use separate ports for encrypted and unencrypted connections, so simply enabling TLS on your existing port may not work.

Look for:

The pool’s mining server address.
A port explicitly marked TLS, SSL, or secure.
Any special login requirements, such as a wallet address and worker name.

Do not assume that a familiar port number supports TLS. Use the details published by your particular pool.

Enable TLS in your command or configuration

If you start XMRig from a terminal, add --tls:

xmrig -o YOUR_POOL_HOST:TLS_PORT -u YOUR_XMR_WALLET -p x --tls

Replace the uppercase placeholders with your actual pool address, TLS port, and Monero wallet address. The -p x part supplies a pool password; many pools accept x, but follow your pool’s instructions.

If you use config.json, find your pool entry inside the "pools" list and enable TLS there:

{
  "pools": [
    {
      "url": "YOUR_POOL_HOST:TLS_PORT",
      "user": "YOUR_XMR_WALLET",
      "pass": "x",
      "tls": true
    }
  ]
}

This is a minimal example, not a replacement for every setting in your existing file. Keep your other settings and change the relevant pool entry. If you have backup pools, configure TLS separately for each one.

Restart XMRig after saving the file. Check its startup messages for a successful TLS connection, then look for accepted shares. A share is a piece of mining work submitted to the pool.

Use a certificate fingerprint for extra assurance

Encryption and server identity are different concerns. Do not assume XMRig checks a pool’s identity exactly as your web browser checks a secure website.

XMRig supports certificate pinning: checking the server’s security certificate against a specific fingerprint, a distinctive value calculated from that certificate.

If your pool publishes a trusted certificate fingerprint, you can use:

--tls-fingerprint=POOL_CERTIFICATE_FINGERPRINT

Or add this to that pool’s configuration entry:

"tls-fingerprint": "POOL_CERTIFICATE_FINGERPRINT"

Get the fingerprint from the pool’s official, trusted instructions—not an unsolicited message. If the pool replaces its certificate, the fingerprint may change. Verify the replacement before updating your settings.

Fix connection problems without guessing

If TLS fails:

Check the port: TLS cannot usually connect to a plain, unencrypted mining endpoint.
Check your XMRig build: It must include TLS support. Use a current official release rather than an unknown repackaged download.
Check any pinned fingerprint: A mismatch may mean a certificate change, a configuration mistake, or an unsafe connection.
Check network restrictions: A firewall may block the pool’s port.

TLS does not increase mining speed, hide mining activity completely, or make a dishonest pool trustworthy.

The bottom line

Use your pool’s documented TLS endpoint, enable --tls or "tls": true, and confirm that shares are accepted. For stronger server identity checks, pin a fingerprint you have verified through a trusted source.

All 1,000 questions