Plugin not working when using self signed SSL certificate or using cert: true in config

[krishnasen2401]

Is there an existing issue for this?

• I have searched the existing issues

OS/Web Information

• Web Browser:Edge,chrome android
• Local OS Host: Linux using termux
• Remote OS:Windows 11,Android
• Remote Architecture:intel 64 bit
• code-server --version: latest

Steps to Reproduce

1.Change config.yaml cert:false to cert:true
2.Bind address: 0.0.0.0:8080
3.access using IP address other than localhost
4:Open the file support by the SQL plugin

plugin link :- https://github.com/qwtel/sqlite-viewer-vscode
file :- database.db (sqlite)

Expected

1)Open db file and show data
2) similar behaviour when accessing the code-server via localhost

Actual

Getting error :- Error loading webview: Error: Could not register service worker: SecurityError: Failed to register a ServiceWorker for scope ('https://192.168.29.11:8080/stable-effc6e95b4ad1c5ac5f9083ec06663ba4a2e005c/static/out/vs/workbench/contrib/webview/browser/pre/') with script ('https://192.168.29.11:8080/stable-effc6e95b4ad1c5ac5f9083ec06663ba4a2e005c/static/out/vs/workbench/contrib/webview/browser/pre/service-worker.js?v=4&vscode-resource-base-authority=vscode-resource.vscode-cdn.net&remoteAuthority=192.168.29.11:8080'): An SSL certificate error occurred when fetching the script..

and not displaying the file

Logs

No response

Screenshot/Video

No response

Does this bug reproduce in native VS Code?

No, this works as expected in native VS Code

Does this bug reproduce in GitHub Codespaces?

I did not test GitHub Codespaces

Are you accessing code-server over a secure context?

• I am using a secure context.

Notes

ssl using self signed cert by using cert:true or attach a self signed cert using openssl

logs
output.txt

[code-asher]

Ah yeah, that would be using a web view, and that uses service workers, and browsers usually do not allow service workers unless the certificate is valid.

You will either have to get a real domain and certificate, or use localhost in some way, or disable the check in your browser. For example in Chromium you should be able to open chrome://flags/#unsafely-treat-insecure-origin-as-secure and add https://192.168.29.11:8080/.

I will close though since this is a browser limitation and not a code-server bug.

I think we should probably document this or show a message, but we have #5671 for that. I will edit the title a bit to make it easier to find.