user123331: When I connect to my bitcoind instance over RPC, I need a password for that, but no certificate.
So how are man-in-the-middle attacks prevented on that connection?

user208: The JSON-RPC interface is intended for local access. By default it will only accept connections from localhost, but it can be configured to be accessed for a wider netmask; e.g. a trusted LAN network.
If you have a need to access it over an untrusted network like the internet, tunnel it through technology specifically designed for that, such as stunnel (SSL) or a VPN. Getting the details of that right and secure is hard, and is considered outside of Bitcoin Core's scope.
For more information, see the documentation.

123331: <p>When I connect to my bitcoind instance over RPC, I need a password for that, but no certificate.</p>
<p>So how are man-in-the-middle attacks prevented on that connection?</p>
 208: <p>The JSON-RPC interface is intended for local access. By default it will only accept connections from localhost, but it can be configured to be accessed for a wider netmask; e.g. a trusted LAN network.</p>
<p>If you have a need to access it over an untrusted network like the internet, tunnel it through technology specifically designed for that, such as <code>stunnel</code> (SSL) or a VPN. Getting the details of that right and secure is hard, and is considered outside of Bitcoin Core's scope.</p>
<p>For more information, see the <a href="https://github.com/bitcoin/bitcoin/blob/v22.0/doc/JSON-RPC-interface.md" rel="nofollow noreferrer">documentation</a>.</p>
