SSL considerations - self-signed certificate

kpturner

With normal SSL transactions over HTTP it is possible for the user to add exceptions for incorrectly signed certificates to bypass SSL warnings during testing. This is very useful when the domain being used is not mentioned in the certificate (a fairly common issue when developing and testing).

I would like to know if it is possible to do the same sort of thing with WSS and Lightstreamer?

I would like to test my client/server combination in SSL mode, but the certificate will not necessarily be correctly signed. I don't care about that, I just care about encryption.

Is this possible?

yoadsn

kpturner With normal SSL transactions over HTTP it is possible for the user to add exceptions for incorrectly signed certificates to bypass SSL warnings during testing. This is very useful when the domain being used is not mentioned in the certificate (a fairly common issue when developing and testing).

I would like to know if it is possible to do the same sort of thing with WSS and Lightstreamer?

I would like to test my client/server combination in SSL mode, but the certificate will not necessarily be correctly signed. I don't care about that, I just care about encryption.

Is this possible?

Did not get a chance to check that but i am pretty sure you can browse with https to the LS internal web server (https://your.push.dns.com) and accept the invalid cert warning.
Your browser should support the fake cert now when an LS connection is initiated.

A more complicated solution is to add the fake CA to your local trusted CAs, but if that doesnt ring a bell i guess its not for you.

Hope that helps.

kpturner

Actually yes that is a very good point - however it seemed to connect without any warning at all even though I know the certificate is incorrectly signed for the domain.

kpturner

What I have found is that if the certificate is correctly signed it connects instantly. If not, it connects eventually (sometimes takes 30 seconds or more). Is this correct?

Giuseppe Corti

Hi Kevin,

I confirm that if you accept the invalid cert warning once for the Lightstreamer push URL (adding an exception rule in the browser) then WSS or HTTPS connections succeed without any additional warnings.

Giuseppe Corti

I am not sure of the possible reasons for the delay, the connection should be instantaneous even with not signed certificates but for which the browser has an exception rule.
It might be a particular setting of the browser makes additional checks against an invalid certificate?
What browser are you using for this test?

kpturner

In this test case I am using Chrome, and I don't ever remember creating an exception for the domain that I am connecting to.....and it is a new PC. I will try to verify that - my memory is not what it used to be :Smile_Ab:

kpturner

I can confirm that I have not added an exception or manually added the CA to my trust store. The connection still works, but it takes much longer to establish the connection. It even resorts to HTTP streaming by the looks of it. Other times it connects with web-socket streaming.

Giuseppe Corti

I am slightly puzzled by this scenario. It seems that your chrome does not care about the invalid certificate and still allows the connection to start.
I confirm you that the SSL ceritificate stuff are handled by the browser outside the Lighstreamer client library.

Have you the opportunity to raise to DEBUG level the logger

[SYNTAX=XML]<logger name="LightstreamerLogger.connections.ssl" level="DEBUG"/>[/SYNTAX]

in this way we can investigate the dynamics of the SSL handshake and maybe figure out where all that time is lost.