将 Socket.IO 与 Apache、Node.js、ZEA52C36203C5F99C3CE2442D5351B 和 Cloud 一起使用

Question

I am creating a website that will connect to a Node.js Socket.IO WebSocket. This node server is running on the port 4923 and the Socket.IO node is configured on the endpoint /socket . I do not want to connect via https://domain1.com:4932/socket but instead from https://domain1.com/socket.io which points to my Apache Server. The firewall blocks the port 4932 in order to block https://domain1.com:4932/socket .

The Apache Server should proxy all connections from https://domain1.com/socket.io to https://localhost:4932/socket SSL included. The SSL cert is a cert from Let's Encrypt.

When a new connection is created the SSL handshake between the Apache and Node.JS servers fails.

My website traffic goes through Cloudflare with the Full universal SSL activated.

In the apache virtual host, I have the following configuration:

<VirtualHost  *:443>
        ...

        SSLEngine On
        SSLProxyEngine On

        SSLCertificateFile /etc/letsencrypt/live/domain1.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/domain1.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf      

        # Handle wss proxy connections
        RewriteEngine On
        RewriteCond %{REQUEST_URI}  ^/socket.io             [NC]
        RewriteCond %{QUERY_STRING} transport=websocket     [NC]
        RewriteRule /(.*)           ws://localhost:4923/$1 [P,L]

        # Autogenerated ProxyPass
        ProxyPass        /socket.io http://localhost:4923/socket
        ProxyPassReverse /socket.io http://localhost:4923/socket
        
        ...
</VirtualHost>

My node.js server via HTTPS:

const port = 4923;

const fs = require('fs');

var options = {
    key: fs.readFileSync('/etc/letsencrypt/live/domain1.com/privkey.pem'),
    cert: fs.readFileSync('/etc/letsencrypt/live/domain1.com/fullchain.pem'),
};

var app = require('https').createServer(options);
var io = require('socket.io')(app, {
    path: '/socket',
    serveClient: false,
    pingInterval: 10000,
    pingTimeout: 5000,
    cookie: false
});

app.listen(port);

io.httpServer.on('listening', function () {
    console.log("Listening on", port);
});

io.on('connect', (socket) => {
    console.log("Socket connected: " + socket.id);
    socket.on('disconnect', () => {
        console.log("Socket disconnected: " + socket.id);
    });
    socket.on('download-request', (id) => {
        onDownloadRequest(socket, id);
    });
});

function onDownloadRequest(socket, id) {
    console.log("Request from " + socket.id + " and video id: " + id);
}

Meanwhile, on the client-side, I create a new WebSocket connection on window load, and then I send the message when a button is clicked.

...
const websocketOptions = {
        server : {
                protocol : 'https://',
                host     : 'domain1.com',
                port     : 443,
                endpoint : '/socket.io'
        }
};

function requestDownload() {
        if (isAnySelected() || socket !== null) {
                console.log(document.getElementsByClassName("download-input-box")[0].value);
                socket.emit('download-request', {id: document.getElementsByClassName("download-input-box")[0].value});
        }
}

function createConnection() {
        console.log("Creating websocket connection!");
        socket = io.connect(websocketOptions.server.protocol
                        + websocketOptions.server.host
                        + ':'
                        + websocketOptions.server.port
                        + websocketOptions.server.endpoint,
                        {transport: 'websocket'});
}

function onWindowLoad() {
        createConnection();
}

window.onload = onWindowLoad;

This results in a response code 500 and this error message in the apache error log:

AH00898: Error during SSL Handshake with remote server returned by /socket.io/, referer: https://domain1.com/

What am I doing wrong? Any help is appreciated.

EDIT:

Now that the SSL handshake problem has been solved a new problem has been happening to me. You can view it here .

Answer 1

You can't SSL "localhost", so there is three options:

• Use one domain that you can request an SSL

• Use "localhost" with HTTP ( not s )

• Use "localhost" with SSL but disabling "SSLProxyCheckPeerName" into Apache2 configuration. ( See this reference )

  SSLProxyCheckPeerName off