Can not established Websocket secure connection on Firefox

Question

I am stuck with Firefox. I could not make WebSocket work on it. I use Tornado Websocket and I initialized it by code below:

app = Application([(r'/mypath/ws', WSHandler)])
http_server = HTTPServer(app, ssl_options={
                "certfile": "~/certs/websocket.crt",
                "keyfile": "~/certs/websocket.key"
            })
http_server.listen("443")

And I initialized it on Javascript side like this:

var WS = new WebSocket("wss://websocket.localhost/mypath/ws");

This code works fine on Chrome, meanwhile, I created the cert by myself and run the page under HTTPS. But Firefox keeps saying that:

Firefox can't establish a connection to the server at wss://websocket.localhost/mypath/ws.

I google it and found too many thoughts but none of'em worked for me :(

Any help will be appreciated.

you created the cert yourself... did you add it to your browser's trusted certificate list? — konghou, May 21 '14 at 06:09
I should not add my own certificate manually to the browser because my clients won't do that. I have to find a permanent solution. — fth, May 21 '14 at 06:15
FatihKaratana Try what konghou said, if it works then you might have to buy a certificate from a trusted issuer. — Javier Mr, May 21 '14 at 06:30

score 20 · Answer 1 · answered Jun 01 '19 at 12:25

20

If it's a self-signed certificate, browsers won't show the dialog to accept the certificate if it's only used in a websocket.
You must first visit the requested url to see and accept the certificate warning, and then you can create the secure websocket.

For example if your websocket url is:
wss://localhost:44300/OpenWebSocket
then visit:
https://localhost:44300/OpenWebSocket
and accept the certificate warning

answered Jun 01 '19 at 12:25

This should be the accepted answer as it explains in detail how to resolve. – Mat Lipe Feb 03 '22 at 17:55
Although should have been proposed as an edit to the answer it quoted. – dbreaux Jul 07 '23 at 17:27

score 11 · Answer 2 · answered May 21 '14 at 13:55

11

If it's a self-signed certificate, browsers won't show the dialog to accept the certificate if it's only used in a websocket. You must first visit a normal page on the same server to see and accept the certificate warning, and then you can create the secure websocket.

answered May 21 '14 at 13:55

Ben Darnell

21,844
3
29
50

1

It still doesn't work even if I go to the host (localhost) before connecting. https://bugzilla.mozilla.org/show_bug.cgi?id=1187666 – B T Jul 26 '15 at 03:45

score 3 · Accepted Answer · answered May 21 '14 at 14:02

I solved my problem via ProxyPass. I created a non-secure Websocket server with Tornado and run it on a specific port such as 3232:

app = Application([(r'/ws/', WSHandler)])
ws_server = HTTPServer(app)
ws_server.listen("3232")

Then I've written a proxypass in my Apache conf and use mod_proxy_wstunnel:

ProxyPass /ws/ ws://127.0.0.1:3232/ws/
ProxyPassReverse /ws/ ws://127.0.0.1:3232/ws/

And I create Websocket client on frontend like this:

var WS = new WebSocket("wss://websocket.localhost:81/ws/")

In this case I can create a connection on a secure connection with https and my port is 81 and my proxypass redirect any Websocket request to locally listened port 3232. It is not a exact solution mostly like a workaround. But it works fine for me.

score 1 · Answer 4 · answered Feb 19 '16 at 23:26

1

Try to open this url https://websocket.localhost/mypath/ws in firefox and accept certificate first.

answered Feb 19 '16 at 23:26

l0pan

476
7
11

score 0 · Answer 5 · edited Feb 20 '17 at 20:13

0

I've solved this problem adding a certificate exception in Firefox's advanced preferences.

edited Feb 20 '17 at 20:13

Scott Stensland

26,870
12
93
104

answered Nov 08 '15 at 12:29

francadaval

2,451
3
26
36

2

You might be solve the issue by that way, but i've got no chance to force my users to do that :( That is the key-point for me. That is why i found a way workaround. – fth Nov 08 '15 at 18:35

score 0 · Answer 6 · answered Sep 02 '21 at 01:53

It happened to me that I created my self-signed certificate in a wrong way, leaving the Basic Constraint -> Certificate Authority = Yes.

You can check that by visiting about:preferences#privacy in firefox, then click on the View Certificates... button. You will see the list of your websites/web apps and their certificates on the Servers tab. Click on your server and then click on the View... button.

A new window/tab will open with the details of the certificate. Scroll down to find the "Basic Constraints" section and there you will see if you generated that certificate declaring yourself as a Certificate Authority (CA). If so, you have to generate your certificate again without that constraint (CA=false)

After doing that, my web application run fine in HTTPS and my websocket server using WSS:// without needing any proxy or other tricks. — jgarcias, Sep 02 '21 at 01:55

score -1 · Answer 7 · answered Mar 16 '18 at 05:41

I was pulling my hair out over this one for a while. I was getting all kinds of cryptic error messages depending on different web browsers, that all made it sound like it was something about certificate exceptions. I had already made exceptions in Firefox and Chrome,

It turned out I had a typo in my sub-protocol string in my Javascript!

Correcting the sub-protocol string made everything better. More information on WebSockets and using sub-protocol(s): https://developer.mozilla.org/en-US/docs/Web/API/WebSocket

Can not established Websocket secure connection on Firefox

7 Answers7

Linked