基于 Apache SSL 的 websocket 上的 MQTT

Question

I have an mqtt broker providing unencrypted websocket. I would like to proxy it through an Apache which should encrypt the websocket to the outside.

It is an Apache 2.4 on a Windows machine.

My config is:

 <VirtualHost *:80> ServerName test.someurl.com RewriteEngine On RewriteCond %{HTTP:Upgrade} =websocket [NC] RewriteRule /(.*) ws://localhost:9876/$1 [P,L] </VirtualHost> <VirtualHost *:443> ServerName test.someurl.com SSLEngine on SSLCertificateFile "C:/Program Files (x86)/Apache24/conf/ssl/some_certificate.crt" SSLCertificateKeyFile "C:/Program Files (x86)/Apache24/conf/ssl/some_key.key" RewriteEngine On RewriteCond %{HTTP:Upgrade} =websocket [NC] RewriteRule /(.*) ws://localhost:9876/$1 [P,L] # Websocket proxy # wss redirects to working ws protocol # ProxyPass /wss ws://127.0.0.1:9876 retry=0 keepalive=On # ProxyPassReverse /wss ws://127.0.0.1:9876 retry=0 </VirtualHost>

I am able to connect through ws / port 80. It works fine. However, I am not able to connect using the wss.

I tried both using a rewriting and also a proxy_pass directives. I tried 100 different solution. However, this one looked most promising as port 80 is working for ws but not for the encrypted part. Any idea? Or I am just blinded by the options O:)

Answer 1

This is an old question, but as I've just got this working:

I have Mosquitto listening on port 8000 (which is firewalled to block any connections other than from localhost)

listener 8000
socket_domain ipv4
allow_anonymous true
protocol websockets

Then setup apache as so:

<VirtualHost *:80>
  ProxyPass /ws/ ws://localhost:8000/
  ProxyPassReverse /ws/ ws://localhost:8000/
</VirtualHost>
<VirtualHost *:443>
    SSLCertificateFile ...
    SSLCertificateChainFile ...
    SSLCertificateKeyFile ...
    ProxyPass /ws/ ws://localhost:8000/
    ProxyPassReverse /ws/ ws://localhost:8000/
</VirtualHost>

Finally, the web-application is set to connect like so:

mqtt.connect((window.location.protocol == "https:" ? "wss:" : "ws:") + "//example.org/ws/");

Note that the proxy protocol can be "ws" or "wss" - both seem to work interchangeably. This is the connection between apache and mosquitto, there's no need to encrypt (they're on the same host). The use of the "/ws/" suffix on the path means I can do without mod_rewrite, and simply use mod_proxy.

This approach is the only way I could require authentication when accessed over HTTPS (which is public) but not over HTTP (which is behind the firewall).