Configuration with SSL?

[ipeychev]

Hello,

Is there an example of configuration with SSL? h2o --help does not provide information how to specify the certificate.

(And thanks for the advices, now I have it up and running).

[kazuho]

Sorry, SSL support exists in the source code (and thus is available if H2O is used as a library) but there is no configuration directive for the server.

Please wait a while.

[ipeychev]

Okay, I will wait, thanks!

[kazuho]

Memo: #23 introduced a callback that should be called when a connection gets closed. Do not forget to call the function when SSL handshake fails.

[kazuho]

Mostly finished by the above commit.

Configuration directive listen has been introduced replacing port. It is possible to setup HTTPS server by using the directive as show in the below example.

listen:
  port: 8081
  host: 127.0.0.1
  ssl:
    certificate-file: examples/server.crt
    key-file: examples/server.key

The leftover is to properly implement multi-thread support in handling SSL (needs to define hooks as is done in http://openssl.6102.n7.nabble.com/When-to-use-CRYPTO-set-locking-callback-and-CRYPTO-set-id-callback-td7379.html).

[ipeychev]

Great job!

I just tried, but I was unable to run it successfully with SSL configuration. Here is my config for my test HTTP2 server, which is running on this domain http2rulez.com:

listen:
port: 8084
ssl:
certificate-file: /home/iliyan/cert/http2rulez.com.cert
key-file: /home/iliyan/cert/http2rulez.com.key
files:
/: /home/iliyan/http2rulez.com/public
request-timeout: 10
mime-types:
txt: text/plain
html: text/html
gif: image/gif
png: image/png
jpg: image/jpeg
jpeg: image/jpeg
css: text/css
js: application/javascript

On this domain I have a few endpoints - SPDY on port 8081, HTTP2 on Port 80 (via node-http2) and so on.

I just configured H2O to run on port 8084 and I tried to connect with Canary and Firefox Nightly. In Canary I have enabled SPDY/4 flag. Both failed to connect to https://http2rulez.com:8084, but they successfully connected via HTTP2 protocol on this address: https://http2rulez.com.

[desaxce]

@ipeychev:

Hi, I am not sure h2o supports AEAD cipher suites. Personally I managed to run an h2o HTTP/2 server with SSL and then I used Firefox Nightly to connect to it (but I had to set network.http.spdy.enforce-tls-profile to false).

Hope that helps.

[kazuho]

@ipeychev @desaxce
It seems true that there is some issue. I have tried setting up a copy site of http2rulez.com using H2O and confirmed that (at least) Firefox Nightly has problem connecting to it via HTTP/2 (reports a SSL MAC error).

Regarding the ciphersuites being supported, H2O does not provide any way to modify the list of ciphersuites from those enabled by OpenSSL by default (we should obviously add a way to configure the list; thank you for noticing it). But in the case of http2rulez.com I do not think that is the cause of the problem.

EDIT: The error also happens with HTTP/1.1 over SSL.

[kazuho]

@ipeychev
Would you mind retrying? I think I have fixed all the issues with commits up to 3de5b06.

I can now access a copy site of http2rulez.com setup for my own using HTTP/2 (HTTPS) using Google Chrome Canary.

[ipeychev]

Great job! It works now on https://http2rulez.com:8084!

[kazuho]

Wow! Thanks a lot!