CODEWITHSUNDEEP
apachesslwebsocketautobahnthruway
Nate
Nate

Reputation: 28424

How to use secure websockets (wss)?

I'm using AutobahnJS and Thruway on my website and everything works fine using a nonencrypted connection:

var connection = new autobahn.Connection({
                                             url: 'ws://www.example.com:9090',
                                             realm: 'restricted_realm'
                                         });

connection.onopen = function (session) {
    alert('yay');
};

connection.open();

However, I am unable to use a secure connection. Changing ws://www.mysite.com:9090 to wss://www.example.com:9090 results in this error in the console:

WebSocket connection to 'wss://www.example.com:9090/' failed: Error in connection establishment: net::ERR_TIMED_OUT

I have an SSL certificate on my server and can access my site via https://www.example.com.

What do I need to do to make secure websockets work?

Upvotes: 2

Views: 4101

Answers (2)

blomnik
blomnik

Reputation: 11

I use HAProxy 1.5+ for SSL termination. Here is part of my config from production.

frontend public
    # HTTP
    bind :80
    # Redirect all HTTP traffic to HTTPS
    redirect scheme https if !{ ssl_fc }

    # HTTPS
    bind :443 ssl crt ssl.pem no-sslv3 ecdhe prime256v1 ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
    acl        is_websocket hdr(Upgrade) -i WebSocket
    use_backend    ws if is_websocket #is_websocket_server
    default_backend    www

backend ws
    server    ws1    127.0.0.1:9090

backend www
    timeout server  30s
    server  www1    127.0.0.1:8080

In my configuration, Apache listening for unencrypted traffic on port 8080 and WebSocket server listening unencrypted traffic on port 9090

Upvotes: 1

daviddan
daviddan

Reputation: 416

Thruway uses Ratchet as the underlying transport for WebSockets, so you can reference their documentation on deploying:

http://socketo.me/docs/deploy

You can also use stunnel or nginx.

Upvotes: 2

Related Questions