Develop Reference

Error setting up wss server: works on localhost, but not with ip address

I'm having issues setting up a wss server (Secure Websocket Server) in node.js.
When we run the server and test it using an online websocket tester and connect to wss://localhost:8888 it works. But when we connect to wss://my_ip:8888 (ip found with ifconfig) it results in the error index.js:15 WebSocket connection to 'wss://192.168.1.217:8888/' failed.
I've made a git repository for easy testing: https://github.com/DaanS8/wss_error
Possible useful info
We pinged the ip on the port 8888 with `telnet my_ip 8888` which was successful. Any other port fails, which means it is listening?
Chrome behaves differently then Firefox, in chrome localhost works but in Firefox localhost doesn't even work whilst using the same tests on the online websocket tester.
The code is running on a ubuntu vm on a windows machine. It seems the ubuntu vm doesn't have its own firwall (sudo ufw status results in error), just turning of the windows firewall doesn't change the errors.
The certificates were generated with the following commands:
openssl genrsa -des3 -out myCA.key 2048
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.pem
Enter pass phrase for myCA.key:
Country Name (2 letter code) [AU]:BE
State or Province Name (full name) [Some-State]:Vlaams-Brabant
Locality Name (eg, city) []:Leuven
Organization Name (eg, company) [Internet Widgits Pty Ltd]:KU Leuven
Organizational Unit Name (eg, section) []:Pno
Common Name (e.g. server FQDN or YOUR name) []:Team x
Email Address []:xxxx#xxxxxxxx.be
openssl rsa -in myCA.key -text > private.pem
My main sources:
https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/
How to Create Secure(TLS/SSL) Websocket Server
main.ts was copied from a blog post that I temporarily can't find anymore
Code
main.ts:
// Minimal amount of secure websocket server
var fs = require('fs');
// read ssl certificate
var privateKey = fs.readFileSync('certs/private.pem', 'utf8');
var certificate = fs.readFileSync('certs/myCA.pem', 'utf8');
var credentials = { key: privateKey, cert: certificate };
var https = require('https');
//pass in your credentials to create an https server
var httpsServer = https.createServer(credentials);
httpsServer.listen(8888);
var WebSocketServer = require('ws').Server;
var wss = new WebSocketServer({
server: httpsServer
});
wss.on('connection', function connection(ws) {
ws.on('message', function incoming(message) {
console.log('received: %s', message);
ws.send('reply from server : ' + message)
});
ws.send('something');
});
See github for keys etc.

Your "online websocket tester" doesn't provide easily readible source code, so it is not clear what is failing. My guess: TLS cert validation is failing. (Browsers may have own rules for localhost, so it may be working for localhost in some browsers).
You are connecting to the IP, but cert is generated Common Name: Team x. Correct TLS client implementation should reject this kind of TLS connection, because server name is not matching TLS CN name ('IP'!='Team x').
Solutions:
1.) Generate proper TLS certificate, where Common Name is matching used IP. This is a proper secure solution for your use case (usually server FQDN is used, because domain is used for connection and not the server IP).
2.) Use websocket client, which provides option to disable cert verification.
3.) Open https://IP:8888 and add browser TLS exception for used cert. Exception should be applied also for wss protocol then.

Try using cloudflaired
for download : Click here
tutorial : Click here
it may be the problem of firewall rules, and other factors
EDIT:
This program packs a lightweight server that acts as a bridge from your computer to cloudflair servers. This hosts the site on a temporary subdomain for free
if you are having a cloudflair account, it will help with setting and configuring static permanent urls instead of dynamically changing every time
Sorry I don't know about the pricing as I use the free plan
for more info visit the docs
Because of this it can bypass many windows restrictions (like firewall) isp restrictions (like nat), etc. So you can focus on the project
Also this works even out of your lan. Just so you know it also works outside the lan. so to share a quick preview to others.

getting public ssl certificate for node.js server

I am running a node.js express server on my aws ac2 linux instance. I need to expose it through https to work properly with the react app that pulls data from it. I was able to generate my own ssl certificate but it will not be recognized by other users and the client app will through an error.
Could you please explain how can i get a public ssl certificate just for the node server. The server uses an ip address like xxx.xx.xx.xx:4500/endpoint. Aws seems to offer ssl but only if you pay for its load balancer and I do not want to do that.
Is there a way to verify the certificate that i generated with openssl so i can use it publicly?
Here is my basic setup:
const express = require('express');
const cors = require('cors');
const mysql = require('mysql');
const moment = require('moment');
var fs = require('fs');
const https = require('https')
const app = express();
xxx
https.createServer({key: fs.readFileSync('server.key'),
cert: fs.readFileSync('server.cert')}, app).listen(4500, () => {
console.log('Listening...')
})
Thank you in advance!

OpenSSL itself is a tool to create self-signed certificates. Those certificates are never trusted by the browser.
Instead, you can use Let's Encrypt with this command:
apt install certbot
certbot certonly --standalone -d example.com
Let's Encrypt is a trusted entity, so their certificates are valid.
Your new certificates will be on a path like this:
/etc/letsencrypt/live/example.com
As others suggested, you will need one domain. You can get one free on sites like Freenom.

Your self-signed certificate won't be trusted by the browser.
One solution would be to get yourself a domain and then a free SSL certificate issued by Let's Encrypt. This would remove the error because Let's Encrypt certificates are trusted by all major browsers.
Another solution is to get the free plan of Cloudflare, which includes an SSL certificate. More info here.
There is the possibility to secure your IP with an SSL certificate but there are no free solutions for this.

If you in a region where Amazon Certificate Manager is suported, You can get a SSL certificate for free.
https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request-public.html
In order to apply ssl certificate, The easiest way is to use it on a load balancer. Check my answer to this question Apollo Server on Ubuntu 18.04 EC2 instance with HTTPS.
If you want to use the certificate directly on EC2. try the following. I haven't tried this myself.
https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-export-private.html
Also i have seen people using https://letsencrypt.org/ to get certs.

Grunt Node and Express Local Dev HTTPS Certificates

I'm trying to make a start at Service Workers and read you require to have an ssl cert.
I've Got an AngularJS 1.x application and a Node Express back end, and I run both independently so I I use grunt serve to run the front end on port 8443 and I use node app.js to run express which is on 7443.
note: I'm doing this on macOS
I used the guide on how to set up https on a project that uses Grunt: here
openssl genrsa -out livereload.key 1024
openssl req -new -key livereload.key -out livereload.csr
openssl x509 -req -in livereload.csr -signkey livereload.key -out livereload.crt
Gruntfile.js
options: {
protocol: 'https', // or 'http2'
port: 8443,
hostname: '0.0.0.0',
key: grunt.file.read('livereload.key'),
cert: grunt.file.read('livereload.crt')
},
node app.js
var privateKey = fs.readFileSync('../livereload.key', 'utf8');
var certificate = fs.readFileSync('../livereload.crt', 'utf8');
var credentials = {key: privateKey, cert: certificate};
httpsServer.listen(7443, config.ip, function () {
console.log('Express server listening on %d, in %s mode', 7443, app.get('env'));
});
Both start with no errors, the front end does complain the connection is not private. When my front end tried to hit an endpoint on the express server I receive the following;
OPTIONS https://localhost:7443/api/census/general net::ERR_INSECURE_RESPONSE
Could someone please assist on this problem of mine.

You have created a self-signed certificate, which is fine for development and testing but is considered unsafe for general use. Unlike SSL certificates purchased from reputable third-parties, self-signed certificates are untrusted by default.
You will need to tell your OS to explicitly trust the certificate. I'm unfamiliar with Mac OS but this question was previously answered on SuperUser.

Node.js https connection using a modern cipher not working

I used OpenSSL to generate a certificate with the following steps:
~/openssl genrsa -out server.key 2048
~/openssl req -new -x509 -key server.key -out server.crt -days 730
And then loaded these files into node.js
var https = require('https');
var privateKey = fs.readFileSync('./server.key', 'utf8');
var certificate = fs.readFileSync('./server.crt', 'utf8');
var credentials = {
key: privateKey,
cert: certificate
};
var app = express();
var httpsServer = https.createServer(credentials, app);
This way, my server was running as expected. But in Chrome, when i click View Site Information, it was saying that I use an "obsolete cipher suite"..
So I checked Google's certificate, and it was saying a "modern cipher suite".
Only difference between my self-signed certificate and Google's was the Key Exchange Algorithm which was RSA on my side and ECDHE_ECDSA on Google's side.
So I decided to create a new certificate using;
~/openssl ecparam -name prime256v1 -genkey -param_enc explicit -out server.key
~/openssl req -new -x509 -key server.key -out server.crt -days 730
Files are created, and node.js gives no error about anything. But when I try to connect to server, my browser simply closes the connection (ERR_CONNECTION_CLOSED) with no indication of error on both server and client side.
I tried different private keys with different parameters but no luck. A simple error message somewhere would help a lot but I'm stuck for hours Googling about how to create Modern Ciphers, trying those out and end up having nothing.
So my question is, how am I supposed to create a self-signed strong/modern cipher (with openssl) that can work with Node.js https module?

Express and SSL usage

I've purchased a Comodo SSL certificate to make SSL server with express. I have these files.
AddTrustExternalCARoot.crt
COMODORSAAddTrustCA.crt
COMODORSADomainValidationSecureServerCA.crt
mysite.com.key
mysite.com.csr
mysite_com.crt
According to a lot of documents I need .pem files. But nobody is saying what is that .pem files?
var options = {
key: fs.readFileSync('/key.pem'),
cert: fs.readFileSync('/cert.pem'),
ca: fs.readFileSync('/ca.pem')
};
It'd be great if there is a tutorial.

Try this answer. PEM is just a format than other SSL formats, and is very common.
Comodo may have already provided you a .pem file, but just named it .crt.
OR you may be able to request a .pem file in place of a DER-formatted file.
OR, you can use OpenSSL to convert from one format to another.
openssl rsa -inform DER -outform PEM -in mysite.com.key -out mysite.com.key.pem
openssl x509 -inform DER -outform PEM -in mysite.com.crt -out mysite.com.crt.pem

Simply start ssl OR simple way to use PEM NPM
var https = require('https'),
connect = require('connect'),
fs = require("fs");
var port = 3000;
var options = {
key: fs.readFileSync('/key.pem'),
cert: fs.readFileSync('/cert.pem'),
ca: fs.readFileSync('/ca.pem')
};
var app = express();
/* express setting */
server = require('https').createServer(options, app),
server.listen(port);
PEM npm is easiest way to start node server with SSL
like
$> npm install pem
var https = require('https'),
pem = require('pem'),
express = require('express');
pem.createCertificate({days:1, selfSigned:true}, function(err, keys){
var app = express();
https.createServer({key: keys.serviceKey, cert: keys.certificate}, app).listen(443);
});