You have decided to stop mining in plaintext, good. Now the question is how: wrap your existing connection in TLS, or move to full Stratum V2? Both encrypt your traffic, but they are different tools. This guide compares them on the things that actually decide it: what they protect, how much they change, and what your hardware supports.
The one-line difference
TLS takes the ordinary Stratum V1 protocol and puts it inside an encrypted tunnel, exactly like HTTPS does for a website. The protocol underneath is unchanged; it is just no longer readable in transit. Stratum V2 is a new protocol built from scratch with encryption inside it, plus pool authentication, a compact binary format, and job declaration. TLS is a wrapper; V2 is a redesign.
Side by side
| Aspect | Stratum over TLS | Stratum V2 |
|---|
| Encrypts traffic | Yes | Yes |
| Authenticates the pool | Via certificates | Pinned authority key |
| Message format | JSON (V1) | Compact binary |
| Job declaration | No | Optional |
| Setup effort | One setting | Firmware or proxy |
| Hardware support | Wide (V1 firmware) | Growing |
Where TLS wins: speed of adoption
TLS's advantage is friction. If your firmware supports it, and a lot of V1 firmware does, including AxeOS on the Bitaxe, you change one thing: the stratum URL becomes a stratum+ssl:// address pointing at the pool's TLS port. No proxy, no new firmware, no extra hardware. In under a minute you go from postcard to sealed envelope. For a device you will leave running for months, that is a big return on almost no effort.
Where Stratum V2 wins: everything else
Once you are past the setup, V2 is simply more capable. Its pinned authority key makes pool impersonation mathematically impossible rather than depending on certificate trust chains. Its binary framing cuts bandwidth and delivers new jobs faster, trimming stale shares. And it uniquely supports job declaration, letting miners choose their own transactions. TLS cannot do any of that, because underneath it is still plain V1.
How to decide
- Firmware speaks V2 natively (for example Braiins OS): use V2. You get everything, and setup is just entering the endpoint and key.
- V1-only firmware, want maximum security: run an SV2 translation proxy for full V2, or start with TLS today and add the proxy later.
- V1-only firmware, want it done in a minute: use TLS now. It is the single fastest way to stop mining in the clear.
You are not locked in
The best part is that this is not a permanent choice. mkpool runs plaintext, TLS, and native V2 ports side by side, so you can point a miner at TLS today and switch it to V2 tomorrow by changing the URL. Both go to the same zero-fee, non-custodial pool. Grab the ports from your chain's connect page or the SV2 ports reference and start with whichever your hardware supports.
Comments
Loading comments...
Leave a comment