server gave HTTP response to HTTPS client

[jbenet]

Trying to use basic auth w/ https

my cluster node's config has:

  "api": {
    "restapi": {
      ...
      "basic_auth_credentials": {
        "theuser": "thepass"
      }
    }
  },

ipfs-cluster-ctl fails

> ipfs-cluster-ctl --host /ip4/1.2.3.4/tcp/9094 --basic-auth "theuser:thepass" id
An error occurred:
  Code: 0
  Message: Get https://1.2.3.4:9094/id: http: server gave HTTP response to HTTPS client

Guessing i have to enable "https" on ipfs-cluster-service somehow. but not sure how. config opt?

---

ipfs-cluster-ctl --force-http works

> ipfs-cluster-ctl --host /ip4/1.2.3.4/tcp/9094 --basic-auth "theuser:thepass" --force-http id
Qmb....
  > Addresses:
     ....

curl w/ http basic auth works:

> curl --basic --user theuser:thepass http://1.2.3.4:9094/id
{"id": ... }

curl w/ https basic auth fails:

> curl --basic --user theuser:thepass https://1.2.3.4:9094/id
curl: (35) Unknown SSL protocol error in connection to 1.2.3.4:-9847

[hsanjuan]

@jbenet https://github.com/ipfs/ipfs-cluster/blob/master/docs/ipfs-cluster-guide.md#the-configuration-file

ssl_cert_file and ssl_key_file need to be specified in the config.

[jbenet]

• Ah-- bummer. can it not generate some? (self-signed certs are better than reg http)
• Also: consider using libp2p as a transport for the api (can pipe http over libp2p worst case)

[hsanjuan]

Ah-- bummer. can it not generate some? (self-signed certs are better than reg http)

I am very split on implementing such thing. On one side, it might be a useful thing to provide and/or default thing to have (but would need --no-check-certificate for it to work which is ugly). On the other, there are like 30 mega-documented ways of producing x502 certificates (can be as simple as openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout server.key -out server.crt), so adding and maintaining another one might be overkill.

Also: consider using libp2p as a transport for the api (can pipe http over libp2p worst case)

This might be a better approach (can take advantage of https://github.com/hsanjuan/go-libp2p-http): offering the user whether to expose a libp2p endpoint and using thus getting an encrypted channel for free.

[jbenet]

yeah, +1 for libp2p.

[hsanjuan]

We expose the http API through libp2p since a while ago. closing this. #349

[erangaeb]

Wrote a post about enabling IPFS Cluster Basic Authentication in docker-based environment.