TLS support for WebSocket out node

[kitazaki]

@phoddie

@mshioji mentions ssl/tls support on http request node in #120

I think that HTTP and MQTT client nodes support TLS now, but WebSocket out node doesn't support TLS yet.
I was asked the issue from Node-RED user and tried MQTT out node with TLS option, but it displays the error with "unimplemented" message.

(wss://url without TLS option)

(wss://url with TLS option)

Is it possible to support TLS option in WebSocket out node ?
If not, is there any difficulty to support TLS option ?

ws://url without TLS works fine on my environment :-)

[phoddie]

@kitazaki – As you observed, TLS is not currently implemented for WebSockets under Node-RED MCU. It is possible. However, it is a little complicated. The challenge is propagating the TLS configuration (certificate, etc) through the stack:

• websocket-client node (which is used by both WebSocket In and WebSocket Out nodes)
• WebSocket object (this is a Web-compatible class. It has no way to pass TLS credentials, so we must extend the API)
• ECMA-419 WebSocket client

Both the WebSocket object and ECMA-419 WebSocket client have some TLS support. However, they do no support user-specified certificates, which is required for Node-RED MCU Edition.

I have always intended to support TLS for the WebSocket Nodes. If it was easy, it would be done. ;) Maybe I can find some time to take another look.

[phoddie]

I had a little time to spend on this today. The situation is not too bad, actually.

• I confirmed that the low-level ECMA-419 websocketclient works with TLS. This just required adding a "wss" configuration, no code changes.
• I confirmed that the WhatWG compatible WebSocket also work with TLS when given a wss:/ URL. Again, this just required adding a "wss" configuration
• Rereading the WebSocket implementation I was reminded that its constructor already accepts an options object in place of the href argument. That provides a place to pass the TLS configuration through from the Node-RED MCU Edition WebSocket nodes.

So.... this is mostly just a matter of connecting some dots. Fingers crossed. I just need to find some more time to do that....

FWIW – the "chilkat.io" server that the ECMA-419 examples use as an echo server is "ws:" only. It doesn't support "wss:". Someone brought back "echo.websocket.org/.ws". It only works with "wss:/". I can use that to test this work.

[phoddie]

TLS support for WebSocket In and Out nodes is committed. It is only tested with echo.websocket.org so please let me know how it goes. (Set up the TLS-Config node in the same way as for secure MQTT connections).

One small change is required in the Moddable SDK for this to work. That isn't live yet, but will be later this week. You can apply the change manually in the meantime. In $MODDABLE/examples/io/tcp/websocket/WebSocket.js change line 60 from...

config = device.network.wss;

...to:

config = {...(options?.wss ?? device.network.wss)};

[kitazaki]

@phoddie
Thank you ! It works fine with my Node-RED WebSocket server !
The url is like this.

It works with another WebSocket service, but the error occurred.
https://piehost.com/ (It's free, but the registration is required.)

The url is like this.

msg.payload data is "1716188966040" and it reaches to the piehost by checking its log.

[phoddie]

@kitazaki – Thank you for confirming that the TLS connection is working.

The additional problem you report does not appear to be TLS related. I don't think I can diagnose it without seeing the flow you used. Would you please share that? Thank you.

[phoddie]

I am able to reproduce the problem you show if there is no "WebSocket In" node for the WebSocket Client and it receives a message. I committed a fix for that. Maybe it helps?

[kitazaki]

@phoddie

the flow is below.
I use only "WebSocket out" node with no "WebSocket in" node.

It works fine for my environment.
I think that it is finished to support TLS for WebSocket nodes.

[phoddie]

Thanks for the good news and for sharing the image of the flow. The exception when there is input received but no WebSocket In node is unrelated to TLS. It could happen with an unsecured ws: connection.

Since this is a Q&A thread, would you please make it as answered?

[mshioji]

Hello, @phoddie , @kitazaki ,
Thank you for your great work, Peter-san and Kitazaki-san.

I just curious that if I running WebSocket server on the cloud-Node-RED with "Websocket-In" node by "Listen On",
I couldn't find TLS settings for it. *This is not a node-red-mcu issue but I'm happy if someone knows about this.
( I don't know but It could be a known story? )

I mean...

• Using "WebSocket-Out" with "ws" by "Connect to", I could connect to my cloud-Node-RED "WebSocket-In" like this:
  

• then switch it to "wss" , TLS settings are displayed as you know.
  

• however, on the server side, there are nothing about TLS settings like this, it seems no place to set key and cert.
  
  

(In a similar case, aedes MQTT Broker node has an explicit TLS setting.)

Thank you, have a good day!

[phoddie]

It appears that the Node-RED editor does not allow a TLS configuration for a WebSocket listener. Even if it did, the WebSocket and HTTP servers ("listeners") in Node-RED MCU Edition do not currently support TLS.

[mshioji]

Hi @phoddie , Thanks for make it clear.
I understand it seems we should look for another solution from Mode-RED if we would like to setup server with wss.
I think this is a server side issue, therefore for MCU, I believe WebSocket Out support is enough.

Thank you very much,

[kitazaki]

@mshioji
WebSocket listener is using same port as Node-RED.
Node-RED configuration is defined in settings.js as below.

https: {
key: require("fs").readFileSync('/data/certs/privkey.pem'),
cert: require("fs").readFileSync('/data/certs/fullchain.pem')
},

Secure "WebSocket in" node depends on that TLS setting.

"MQTT Broker" node is using different port from Node-RED.
1883 is for MQTT and 8883 is for MQTTS as default, so it has TLS setting its own.

[kitazaki]

@mshioji

add https configuration to settings.js in ~/.node-red

https: { key: require("fs").readFileSync('/data/certs/privkey.pem'), cert: require("fs").readFileSync('/data/certs/fullchain.pem') },

run Node-RED (below is docker case)

$ sudo docker run -d -p 443:1880 -v /home/ubuntu/.node-red:/data nodered/node-red:latest

[mshioji]

Hi @kitazaki -san,

Thank you for the information, oh, Node-RED settings.js works for it!
I will try it later in my environment.

... there are many options in settings.js! ^^
Thank you!