What it is for
The privacy win is already yours: you run the Electrum server. A public one gets asked for the
history of every address in your wallet, and that tells it which addresses and which balance
belong to one person. Your own server never reports back.
What is left is a trade. Tor is the more private way in, and every wallet
speaks it. But it adds hundreds of milliseconds to every request, it drops when a phone sleeps
or changes network, and plenty of networks block it outright. Electrum Gate is the other side
of that trade: a TLS front door on your node. Fast, no fingerprint to type over, and it works
on any network you happen to be on.
The certificate
It reuses the Let's Encrypt certificate your reverse proxy already manages, so there is
nothing to request and nothing to renew. A renewal is picked up on its own, without dropping
connections that are already open. You can also upload a certificate you manage yourself, if
you do not run a reverse proxy on this machine.
When more than one certificate could fit and you have not chosen, the app refuses
rather than picking one. A wrong certificate gives a connection that looks fine and only breaks
later, inside your wallet, on name verification.
Nothing in the middle
The connection runs from your wallet straight to your own node, encrypted with a certificate
you already own, for a domain you already control. There is no account to create, no tunnel
service that terminates your traffic along the way, and no client to install on every device
you use: the wallets already speak TLS, they only need an address. What it does ask of you is
one forwarded port on your router.
What the Status card does and does not prove
The app opens a TLS connection to its own front door every minute and checks that the
certificate it gets back is the one you selected. Running means that
succeeded.
It is measured from inside the app, so it says nothing about the way in from outside: a router
that no longer forwards the port, or a firewall in between, still reads as Running here. If a
wallet cannot connect while this card says Running, the fault is on the route and not in this
app.
Which wallets
Useful for wallets connecting from outside your home: Trezor Suite, Electrum, Sparrow,
BlueWallet, Nunchuk, Blockstream and BitBoxApp. Apps on the Umbrel itself do not need it, they
already reach the Electrum server directly.
