ws to wss #161

t3chn0r · 2014-01-05T17:55:43Z

I need some help as I've been trying to do this for the last couple of days without luck. I recently switched my application to https, everything is working fine except for websockets. If I still try to connect to my server using the address ws://ws.myserver.com:8888/ I get the following error now:

SecurityError: The operation is insecure.

I guess this error makes sense as I'm trying to establish an unsecured connection from a secured site. So, I changed the connection string to wss://ws.myserver.com:8888/, and I know Ratchet doesn't support SSL as it will be too slow for PHP to handle.

Because I'm using Nginx I'm trying to do some kind of redirect from wss to ws to no avail. My Ratchet server is running in port 8888, I went ahead and changed the connection string to wss://ws.myserver.com:18888/ and then put these lines (based on documentation I found) in nginx but it still doesn't work...

server {
    listen 18888;
    server_name *.myserver.com;

    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_session_timeout 5m;
    ssl_protocols SSLv2 SSLv3 TLSv1;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://192.168.1.100:8888;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }
}

Now, I get the following error, I guess something is still not quite right but at this point I'm lost...

Firefox can't establish a connection to the server at wss://ws.myserver.com:18888/.

Any ideas what I'm missing?

Appreciate any help...

The text was updated successfully, but these errors were encountered:

t3chn0r · 2014-01-07T20:31:59Z

Anyone? :(

igorw · 2014-01-07T21:13:14Z

Try and toy around with openssl s_client -connect ws.myserver.com:18888. That might tell you if it's the SSL connection that is failing. Also, look at the nginx error logs.

t3chn0r · 2014-01-07T22:36:22Z

Hello @igorw, I've been doing that for the last couple of days, trying the openssl command (openssl s_client -connect ws.acme.net:10088) gives me this (it doesn't look like there's any error at all):

CONNECTED(00000003)
depth=0 C = US, ST = New Jersey, O = Acme LLC, CN = *.acme.net, emailAddress = admin@acme.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = US, ST = New Jersey, O = Acme LLC, CN = *.acme.net, emailAddress = admin@acme.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=New Jersey/O=Acme LLC/CN=*.acme.net/emailAddress=admin@acme.com
   i:/C=US/ST=New Jersey/O=Acme LLC/CN=*.acme.net/emailAddress=admin@acme.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICZzCCAdACCQD0wTwc3sllnDANBgkqhkiG9w0BAQUFADB4MQswCQYDVQQGEwJV
...
6tuOw1XFyhjkvp7eFJiCR6R+Vq0AnX4okVJfj3CfpmG4tMyCEr2RIoK/Xw==
-----END CERTIFICATE-----
subject=/C=US/ST=New Jersey/O=Acme LLC/CN=*.acme.net/emailAddress=admin@acme.com
issuer=/C=US/ST=New Jersey/O=Acme LLC/CN=*.acme.net/emailAddress=admin@acme.com
---
No client certificate CA names sent
---
SSL handshake has read 1172 bytes and written 375 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : ECDHE-RSA-AES256-SHA
    Session-ID: C42F ... 2722
    Session-ID-ctx: 
    Master-Key: D022 ... 7ABA
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 9d 2c 0e 9c 7c 00 1b 4a-97 e7 2c 3e 44 65 26 7e   .,..|..J..,>De&~
    0010 - 9a 0f 2b 36 fc 60 c4 2c-c4 79 dd 9e 23 23 a8 14   ..+6.`.,.y..##..
    0020 - f0 36 49 c7 f0 b6 c8 f5-09 c0 b1 ce 99 e1 b1 8d   .6I.............
    0030 - b6 07 c5 1e e8 19 33 d1-b8 91 9c 94 5f b3 69 db   ......3....._.i.
    0040 - d0 b6 be 44 59 14 36 62-66 ba 9e 9d 1c 31 cd 2c   ...DY.6bf....1.,
    0050 - cb d2 e5 2d a9 1f 48 1a-25 8d fb c5 8d 09 f7 93   ...-..H.%.......
    0060 - 7f f9 71 4b 5e d3 8e 06-3a a7 38 5c b4 be b9 ec   ..qK^...:.8\....
    0070 - 8c a5 f3 46 d0 2b 53 83-f4 78 c9 bc b2 25 73 95   ...F.+S..x...%s.
    0080 - bc 89 1a 48 e7 78 20 24-63 1e 94 c7 e9 80 68 3d   ...H.x $c.....h=
    0090 - fa 7c f3 de dc 92 9e 8b-e3 51 16 66 95 48 2d 7e   .|.......Q.f.H-~

    Start Time: 1389133543
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
closed

Nginx logs don't show anything at all, like nothing was "handled" by Nginx. This is what I have in Nginx right now:

upstream websocket {
        server ws.acme.net:8888;
}

server {
    listen 10088;
    server_name ws.acme.net;

    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    # Logging
    error_log /var/log/nginx/ws.acme.net.error.log;
    access_log /var/log/nginx/ws.acme.net.access.log;

    location / {
        proxy_pass http://websocket;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # WebSocket support (nginx 1.4)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }
}

If I try to connect using wss://ws.acme.net:10088 nothing is shown on the Nginx logs, however, if I remove the ssl lines I get the following in the access log:

192.168.1.100 - - [07/Jan/2014:17:34:37 -0500] "\x16\x03\x01\x00\xA8\x01\x00\x00\xA4\x03\x03R\xCC\x80\xFDRB\x82\xB9\x85\x7F\xC2\xEC\xB3-l\xB6\x84\xE1;H\x1D\xCE\xD7\x97\xC1\xDA\xB1\x89\xD8\x8C\xEE\x9E\x00\x00$\xC0+\xC0/\x00\x9E\x00\x9C\xC0" 400 172 "-" "-"

Not sure at this point what else I can test really... If you think of anything else I'll be more than glad to test it.

Regards and thanks for the help.

t3chn0r · 2014-01-08T16:18:10Z

Some more tests... Not sure if there's anything else that I should change in Ratchet on somewhere else at this point.

Ratchet WebSocket server is running at ws.acme.net:8888

This works (client connection string: ws://ws.acme.net:10088):

Nginx configration (ssl is disabled):

upstream websocket {
        server ws.acme.net:8888;
}

server {
    listen 10088;
    server_name ws.acme.net;

    #ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_protocols SSLv2 SSLv3 TLSv1;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # Logging
    error_log /var/log/nginx/ws.acme.net.error.log;
    access_log /var/log/nginx/ws.acme.net.access.log;

    location / {
        #access_log off;
        proxy_pass http://websocket;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # WebSocket support (nginx 1.4)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;

        proxy_redirect off;
    }
}

This doesn't work but it's fine because I'm trying to access wss but ssl is still disabled in Nginx (client connection string: wss://ws.acme.net:10088):

Nginx setup (ssl is still disabled):

upstream websocket {
        server ws.acme.net:8888;
}

server {
    listen 10088;
    server_name ws.acme.net;

    #ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_protocols SSLv2 SSLv3 TLSv1;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # Logging
    error_log /var/log/nginx/ws.acme.net.error.log;
    access_log /var/log/nginx/ws.acme.net.access.log;

    location / {
        #access_log off;
        proxy_pass http://websocket;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # WebSocket support (nginx 1.4)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;

        proxy_redirect off;
    }
}
Nginx logging entry:
192.168.1.100 - - [08/Jan/2014:11:11:17 -0500] "\x16\x03\x01\x00\xA8\x01\x00\x00\xA4\x03\x03R\xCDx\xA5H\xB9b:%\xEA\xE235\xF6K\x8D\xB4\x9A]L\xF6\xBBC\x9D\x04\x88'\x07\x8F\xD3\xE6\x02\x00\x00$\xC0+\xC0/\x00\x9E\x00\x9C\xC0" 400 172 "-" "-"

This doesn't work either but nothing is being written to the Nginx logs (client connection string same as before: wss://ws.acme.net:10088):

Nginx setup (ssl is now enabled):

upstream websocket {
        server ws.acme.net:8888;
}

server {
    listen 10088;
    server_name ws.acme.net;

    ssl on;
    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_protocols SSLv2 SSLv3 TLSv1;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # Logging
    error_log /var/log/nginx/ws.acme.net.error.log;
    access_log /var/log/nginx/ws.acme.net.access.log;

    location / {
        #access_log off;
        proxy_pass http://websocket;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # WebSocket support (nginx 1.4)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;

        proxy_redirect off;
    }
}

By the way, I'm running Nginx 1.4.4 in case someone is wondering.

t3chn0r · 2014-01-24T16:28:19Z

Ended up installing stunnel... I couldn't make it work with Nginx.

L0HENGRIN · 2014-12-04T17:04:41Z

Had similar problems with nginx installed from the ubtuntu 12.04.x Linux repository, which was an 1.2.x version: No connection possible via wss://. Using the wscat tool* didn't succeed, also. After trying around a lot i suspected nginx to be the root of the problem. So i uninstalled nginx, grabbed the latest of nginx via PPA*, installed it (for me it was a 1.6.2 version) and problems were gone. And as nginx config i wrote this, wich is based on the nginx websocket example:

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

# my ratchet websocket server internal
upstream websocket {
    server 192.168.1.12:8080;
}

server {
        # listen on this port external
        listen 8081;

        # SSL
        ssl on;
        ssl_certificate /opt/lampp/etc/ssl.crt/server.crt;
        ssl_certificate_key /opt/lampp/etc/ssl.key/server.key;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 5m;

        # route all to "websocket"
        location / {
                proxy_pass http://websocket;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }
}

The above works fine at least if i use Chrome Browser for Client.
If using Firefox, the Browser says: "Firefox can't establish a connection to the server at wss://dev.mvc.de:8081/". This is due to the fact that FF does have problems with my self signed certificate but thanks to this google groups post***, it can be fixed by simply calling the websocket address via Firefox Browser with a https protocol once - so in my case: https://dev.mvc.de:8081 . Then FF opens a dialogue which allows to accept the self signed certificate.

[EDIT] 2014-12-04 20:22:00, added FF Fix and Link to the google groups post

kevspadillo · 2015-03-07T01:20:25Z

Hi @t3chn0r!

Recently, I started using ratchet for my project using web socket. And now I am trying to use wss: for secured connection. My question is, how did you managed to use stunnel for ratchet. I saw your comment last Jan 24, 2014 that you ended up using stunnel. Did it worked? How? Can you help me out?

Thanks!

bobvandevijver · 2015-03-07T08:36:41Z

@makhulhet I also use the secure websockets with stunnel, which is easy to setup. I just run stunnel and specify the config location als argument, which has the following content:

sslVersion = all
foreground = no
debug = 1
; Disable support for insecure SSLv2 protocol
options = NO_SSLv2
[websockets]
accept  = 8080
connect = 8081
TIMEOUTclose = 0
cert = /etc/apache2/ssl/mycert.cert
key = /etc/apache2/ssl/mykey.key

That's all! Notice that I run the websocket server on port 8081 on the local machine, and that stunnel enables clients to connect to port 8080 with the wss protocol.

t3chn0r · 2015-03-08T16:05:53Z

Hi @makhulhet, using pretty much same values as @bobvandevijver:

key = /etc/nginx/ssl/domain.com.key
cert =  /etc/nginx/ssl/domain.com.unified.crt
CApath = /etc/ssl/certs

socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

setuid = stunnel4
setgid = stunnel4
pid = /var/run/stunnel4/websocket.pid

debug = 6
output = /var/log/stunnel4/websocket.log

[websocket]
accept = 4443
connect = domain.com:8888

Just replace domain.com with your domain.

Regards

kevspadillo · 2015-03-09T23:55:47Z

@bobvandevijver, thanks dude... I'll try that config... by the way... i forgot to mention that I am currently running under apache web server.. will it work?

@t3chn0r, I already used that configuration and it seems it doesn't work on mine.. maybe there's something else you did.. 😄

kevspadillo · 2015-03-10T00:22:35Z

Hi @bobvandevijver, i tried the your configuration... but how am I going to run my server it seems they'll be having port conflict...

PHP Fatal error:  Uncaught exception 'React\Socket\ConnectionException' with message 'Could not bind to tcp://0.0.0.0:8080: Address already in use' in ../vendor/react/socket/src/Server.php:29
Stack trace:
#0 ../bin/push-server.php(22): React\Socket\Server->listen(8080, '0.0.0.0')
#1 {main} thrown in ../vendor/react/socket/src/Server.php on line 29

t3chn0r · 2015-03-10T01:10:33Z

Ho @makhulhet, I just double checked my server and remembered that I ended up using haproxy instead as I was already using it and decided to not run and maintain the stunnel service when haproxy could also take care of that...

If you need the haproxy setup that I'm using just let me know.

kevspadillo · 2015-03-10T01:26:21Z

Hi @t3chn0r, if im going to use haproxy instead of stunnel. Will it work with apache web server?

bobvandevijver · 2015-03-10T07:05:18Z

@makhulhet Just change the port used in you websocket script to 8081, or interchange the ports in the stunnel config.

I use Apache, works perfect.

kevspadillo · 2015-03-10T07:28:05Z

Awesome! It worked!

I just need to create separate vhost for my webserver and add some ssl configuration to my vhost.

Thanks!

kergdgreat · 2018-04-19T08:13:15Z

@bobvandevijver i used your code but its not working.
sslVersion = all
foreground = no
debug = 1
; Disable support for insecure SSLv2 protocol
options = NO_SSLv2
[websockets]
accept = 8080
connect = 8081
TIMEOUTclose = 0
cert = /etc/apache2/ssl/mycert.cert
key = /etc/apache2/ssl/mykey.key

i got apache 2.2 version in my server.

t3chn0r closed this as completed Jan 24, 2014

cboden added the question label Feb 6, 2014

jjsaunier mentioned this issue Aug 16, 2015

Does this bundle support SSL (wss) GeniusesOfSymfony/WebSocketBundle#49

Closed

nfacciolo mentioned this issue Sep 21, 2015

Ssl server configuration GeniusesOfSymfony/WebSocketBundle#64

Closed

arckdash mentioned this issue Apr 7, 2016

Problem with configure SSL websocket connection GeniusesOfSymfony/WebSocketBundle#135

Closed

ruslan-naryzhnyi mentioned this issue Mar 8, 2017

No SSL/WSS support? #489

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ws to wss #161

ws to wss #161

t3chn0r commented Jan 5, 2014

t3chn0r commented Jan 7, 2014

igorw commented Jan 7, 2014

t3chn0r commented Jan 7, 2014

t3chn0r commented Jan 8, 2014

t3chn0r commented Jan 24, 2014

L0HENGRIN commented Dec 4, 2014

kevspadillo commented Mar 7, 2015

bobvandevijver commented Mar 7, 2015

t3chn0r commented Mar 8, 2015

kevspadillo commented Mar 9, 2015

kevspadillo commented Mar 10, 2015

t3chn0r commented Mar 10, 2015

kevspadillo commented Mar 10, 2015

bobvandevijver commented Mar 10, 2015

kevspadillo commented Mar 10, 2015

kergdgreat commented Apr 19, 2018

ws to wss #161

ws to wss #161

Comments

t3chn0r commented Jan 5, 2014

t3chn0r commented Jan 7, 2014

igorw commented Jan 7, 2014

t3chn0r commented Jan 7, 2014

t3chn0r commented Jan 8, 2014

t3chn0r commented Jan 24, 2014

L0HENGRIN commented Dec 4, 2014

kevspadillo commented Mar 7, 2015

bobvandevijver commented Mar 7, 2015

t3chn0r commented Mar 8, 2015

kevspadillo commented Mar 9, 2015

kevspadillo commented Mar 10, 2015

t3chn0r commented Mar 10, 2015

kevspadillo commented Mar 10, 2015

bobvandevijver commented Mar 10, 2015

kevspadillo commented Mar 10, 2015

kergdgreat commented Apr 19, 2018