CODEWITHSUNDEEP
nginxsslwebsocketthruway
Katai
Katai

Reputation: 2937

Can't get a WSS (Secure Websocket) connection with NGINX

I am trying to get a "wss" connection to work over NGINX. "ws", without SSL, works fine.

(I replaced the actual project domain name with "test.thruway.local")

This is the nginx config:

map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
}

upstream thruway_websocket {
        server 127.0.0.1:9090;
}

server {
        listen 9190;
        listen [::]:9190;

        server_name test.thruway.local;

        access_log /var/log/nginx/test.thruway.access_log;
        error_log /var/log/nginx/test.thruway.error_log;

        location / {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                # tried both "https://" and "http://"
                proxy_pass https://thruway_websocket;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection $connection_upgrade;
                proxy_set_header Host $host;

                proxy_ssl_certificate /etc/letsencrypt/live/test.thruway.local/fullchain.pem;
                proxy_ssl_certificate_key /etc/letsencrypt/live/test.thruway.local/privkey.pem;
        }

    # not sure if this is needed here. Tried with and without.
    ssl_certificate /etc/letsencrypt/live/test.thruway.local/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/test.thruway.local/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

Ports are open, requests seem to get through:

# ufw status
Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere                  
Nginx Full                 ALLOW       Anywhere                  
9190/tcp                   ALLOW       Anywhere                  
OpenSSH (v6)               ALLOW       Anywhere (v6)             
Nginx Full (v6)            ALLOW       Anywhere (v6)             
9190/tcp (v6)              ALLOW       Anywhere (v6)

I'm using AutobahnJS to make the request, to port 9190:

new autobahn.Connection( {
  url: 'wss://test.thruway.local:9190',
  realm: 'test'
} );

The nginx access log makes an entry, telling me that it is clearly connecting... but the log itself is a jumbled mess of ASCII codes, and NGINX returns error 400.

Something like this (IP altered):

111.111.11.111 - - [08/Sep/2021:12:57:24 +0200] "\x10\x04\x01\x02\x00\x01\x00\x00\xF0\x03\x02.\xA0\x90\xD1\x10\xA5\xF0\x8C\xF2 (... etc)" 400 182 "-" "-"

Everything works fine, while using only ws instead of wss. I've tried several adjustments, going through any material I could find - nothing seems to work.

No matter what I try, I always get:

"Firefox can’t establish a connection to the server at wss://test.thruway.local:9190/."

Does anyone know what I could try to make this work? I'm thankful for any ideas, I'm out of things to try.

Upvotes: 1

Views: 3010

Answers (1)

Katai
Katai

Reputation: 2937

I think I figured out what was missing here:

server {
     ssl on;
}

I'm still testing the change, but with this, the logs are no longer a garbled mess and connection seems to work fine.

Upvotes: 0

Related Questions