diff --git a/cmd/neofs-node/config.go b/cmd/neofs-node/config.go
index 6ceb5ff12..b22ee099c 100644
--- a/cmd/neofs-node/config.go
+++ b/cmd/neofs-node/config.go
@@ -68,6 +68,9 @@ const (
 
 	// config keys for cfgGRPC
 	cfgListenAddress = "grpc.endpoint"
+	cfgTLSEnabled    = "grpc.tls.enabled"
+	cfgTLSCertFile   = "grpc.tls.certificate"
+	cfgTLSKeyFile    = "grpc.tls.key"
 
 	// config keys for API client cache
 	cfgAPIClientDialTimeout = "apiclient.dial_timeout"
@@ -206,6 +209,10 @@ type cfgGRPC struct {
 	maxChunkSize uint64
 
 	maxAddrAmount uint64
+
+	tlsEnabled  bool
+	tlsCertFile string
+	tlsKeyFile  string
 }
 
 type cfgMorph struct {
@@ -335,6 +342,18 @@ func initCfg(path string) *cfg {
 	maxChunkSize := uint64(maxMsgSize) * 3 / 4          // 25% to meta, 75% to payload
 	maxAddrAmount := uint64(maxChunkSize) / addressSize // each address is about 72 bytes
 
+	var (
+		tlsEnabled  bool
+		tlsCertFile string
+		tlsKeyFile  string
+	)
+
+	if viperCfg.GetBool(cfgTLSEnabled) {
+		tlsEnabled = true
+		tlsCertFile = viperCfg.GetString(cfgTLSCertFile)
+		tlsKeyFile = viperCfg.GetString(cfgTLSKeyFile)
+	}
+
 	state := newNetworkState()
 
 	containerWorkerPool, err := ants.NewPool(notificationHandlerPoolSize)
@@ -377,6 +396,9 @@ func initCfg(path string) *cfg {
 		cfgGRPC: cfgGRPC{
 			maxChunkSize:  maxChunkSize,
 			maxAddrAmount: maxAddrAmount,
+			tlsEnabled:    tlsEnabled,
+			tlsCertFile:   tlsCertFile,
+			tlsKeyFile:    tlsKeyFile,
 		},
 		localAddr: netAddr,
 		respSvc: response.NewService(
@@ -430,6 +452,9 @@ func defaultConfiguration(v *viper.Viper) {
 	v.SetDefault(cfgMorphNotifyDialTimeout, 5*time.Second)
 
 	v.SetDefault(cfgListenAddress, "127.0.0.1:50501") // listen address
+	v.SetDefault(cfgTLSEnabled, false)
+	v.SetDefault(cfgTLSCertFile, "")
+	v.SetDefault(cfgTLSKeyFile, "")
 
 	v.SetDefault(cfgAPIClientDialTimeout, 5*time.Second)
 
diff --git a/cmd/neofs-node/grpc.go b/cmd/neofs-node/grpc.go
index 050c408b9..6f7205a33 100644
--- a/cmd/neofs-node/grpc.go
+++ b/cmd/neofs-node/grpc.go
@@ -7,6 +7,7 @@ import (
 	"github.com/nspcc-dev/neofs-node/pkg/util/logger"
 	"go.uber.org/zap"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
 )
 
 func initGRPC(c *cfg) {
@@ -15,9 +16,20 @@ func initGRPC(c *cfg) {
 	c.cfgGRPC.listener, err = net.Listen("tcp", c.viper.GetString(cfgListenAddress))
 	fatalOnErr(err)
 
-	c.cfgGRPC.server = grpc.NewServer(
+	serverOpts := []grpc.ServerOption{
 		grpc.MaxSendMsgSize(maxMsgSize),
-	)
+	}
+
+	if c.cfgGRPC.tlsEnabled {
+		creds, err := credentials.NewServerTLSFromFile(c.cfgGRPC.tlsCertFile, c.cfgGRPC.tlsKeyFile)
+		if err != nil {
+			fatalOnErr(fmt.Errorf("could not read credentionals from file: %w", err))
+		}
+
+		serverOpts = append(serverOpts, grpc.Creds(creds))
+	}
+
+	c.cfgGRPC.server = grpc.NewServer(serverOpts...)
 
 	c.onShutdown(func() {
 		stopGRPC("NeoFS Public API", c.cfgGRPC.server, c.log)