Cockpit: White Screen after login in on iOS devices (iPhone & iPad)

[Rymblock]

Good Afternoon.

New in github , so I do apologize if this issue was already open and I did not find it.

I have a working cockpit server working over Debian 9 (stable), fully functional when you access from a laptop/desk but with no access from an iPad Pro 10.5.

Screen is just white after the logging window. Tried with every single brower in the app market with no different results.

After few days researching/googling around, cant see how to fix it.

Thanks. Please make me know any defaults you may require.

[leomoty]

It just shows a white screen on my Ipad Mini 2 as well after logging in.

Regarding other apps, I doubt it would matter, if you check section 2.5.6:

https://developer.apple.com/app-store/review/guidelines/#software-requirements

In practice, they all share WebKit as the browser engine, so they should share the same issues.

[martinpitt]

Can you get a JavaScript console there and check for any error messages?

@larskarlitski , @garrett , is this by chance reproducible on your Apple laptop?

[leomoty]

Hey @martinpitt, I asked @hfoy to test. He tested both with 172 locally (his server) and with 178 (my server).

• Cockpit 172 works fine
• Cockpit 178 shows an empty screen and fails with the errors below:

[Error] Failed to load resource: the server responded with a status of 401 (Authentication failed) (login, line 0)
[Error] Failed to load resource: the server responded with a status of 404 (Not Found) (login.min.js.map, line 0)
[Error] WebSocket network error: The operation couldn’t be completed. (OSStatus error -9807.) (x2)
[Error] received unsupported version in init message: undefined
    E (cockpit.js:393)
    S (cockpit.js:416)
    dispatch_data (cockpit.js:365)
    t (cockpit.js:226)
[Error] received message before init:  – “hint”
    S (cockpit.js:420)
    dispatch_data (cockpit.js:365)
    t (cockpit.js:226)

More Websocket Errors (click to expand)

[Error] WebSocket network error: The operation couldn’t be completed. (OSStatus error -9807.) (x2)
[Log] transport closed, dropped message:  – "↵{\"bus\":\"internal\",\"payload\":\"dbus-json3\",\"command\":\"open\",\"channel\":\"1\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "1↵{\"add-match\":{\"path\":\"/machines\",\"interface\":\"cockpit.Machines\"}}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "1↵{\"watch\":{\"path\":\"/machines\",\"interface\":\"cockpit.Machines\"},\"id\":\"2\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "1↵{\"type\":\"s\",\"call\":[\"/user\",\"org.freedesktop.DBus.Properties\",\"GetAll\",[\"cockpit.User\"]],\"id\":\"3\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"command\":\"authorize\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"null\",\"command\":\"open\",\"channel\":\"2\",\"flow-control\":true}" (cockpit.js, line 442)
[Warning] transport closed: disconnected (index.js, line 3621)
[Log] transport closed, dropped message:  – "↵{ \"command\": \"init\", \"version\": 1 }" (cockpit.js, line 442)
[Error] received unsupported version in init message: undefined
    E (cockpit.js:393)
    S (cockpit.js:416)
    dispatch_data (cockpit.js:365)
    t (cockpit.js:226)
[Log] transport closed, dropped message:  – "↵{\"bus\":\"internal\",\"payload\":\"dbus-json3\",\"command\":\"open\",\"channel\":\"1\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "1↵{\"type\":\"s\",\"call\":[\"/user\",\"org.freedesktop.DBus.Properties\",\"GetAll\",[\"cockpit.User\"]],\"id\":\"1\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"null\",\"superuser\":\"require\",\"command\":\"open\",\"channel\":\"2\",\"flow-control\":true}" (cockpit.js, line 442)
[Error] received message before init:  – "hint"
    S (cockpit.js:420)
    dispatch_data (cockpit.js:365)
    t (cockpit.js:226)
[Log] transport closed, dropped message:  – "↵{\"bus\":\"internal\",\"payload\":\"dbus-json3\",\"command\":\"open\",\"channel\":\"3\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "3↵{\"type\":\"s\",\"call\":[\"/user\",\"org.freedesktop.DBus.Properties\",\"GetAll\",[\"cockpit.User\"]],\"id\":\"1\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"null\",\"superuser\":\"require\",\"command\":\"open\",\"channel\":\"4\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"fswatch1\",\"path\":\"/etc/motd\",\"command\":\"open\",\"channel\":\"5\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"fsread1\",\"path\":\"/etc/motd\",\"command\":\"open\",\"channel\":\"6\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"bus\":\"system\",\"payload\":\"dbus-json3\",\"name\":\"org.freedesktop.timedate1\",\"command\":\"open\",\"channel\":\"7\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"add-match\":{\"path\":\"/org/freedesktop/timedate1\",\"interface\":\"org.freedesktop.timedate1\"}}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"watch\":{\"path\":\"/org/freedesktop/timedate1\",\"interface\":\"org.freedesktop.timedate1\"},\"id\":\"2\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"superuser\":\"try\",\"payload\":\"dbus-json3\",\"name\":\"org.freedesktop.systemd1\",\"command\":\"open\",\"channel\":\"8\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "8↵{\"add-match\":{\"path\":\"/org/freedesktop/systemd1\",\"interface\":\"org.freedesktop.systemd1.Manager\"}}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "8↵{\"watch\":{\"path\":\"/org/freedesktop/systemd1\",\"interface\":\"org.freedesktop.systemd1.Manager\"},\"id\":\"2\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"stream\",\"spawn\":[\"date\",\"+%s:%:z\"],\"err\":\"message\",\"command\":\"open\",\"channel\":\"9\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"superuser\":\"try\",\"payload\":\"dbus-json3\",\"name\":\"org.freedesktop.PackageKit\",\"command\":\"open\",\"channel\":\"10\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "10↵{\"call\":[\"/org/freedesktop/PackageKit\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.PackageKit\",\"VersionMajor\"]],\"id\":\"1\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "10↵{\"call\":[\"/org/freedesktop/PackageKit\",\"org.freedesktop.PackageKit\",\"CreateTransaction\",[]],\"id\":\"2\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"bus\":\"system\",\"payload\":\"dbus-json3\",\"name\":\"com.redhat.SubscriptionManager\",\"command\":\"open\",\"channel\":\"11\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "11↵{\"add-match\":{\"path\":\"/EntitlementStatus\",\"interface\":\"com.redhat.SubscriptionManager.EntitlementStatus\",\"member\":\"entitlement_status_cha…" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "11↵{\"call\":[\"/EntitlementStatus\",\"com.redhat.SubscriptionManager.EntitlementStatus\",\"check_status\",[]],\"id\":\"2\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"fsread1\",\"path\":\"/etc/machine-id\",\"command\":\"open\",\"channel\":\"12\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"superuser\":true,\"payload\":\"dbus-json3\",\"name\":\"org.projectatomic.rpmostree1\",\"command\":\"open\",\"channel\":\"13\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "13↵{\"add-match\":{\"path\":\"/org/projectatomic/rpmostree1/Sysroot\",\"interface\":\"org.projectatomic.rpmostree1.Sysroot\"}}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "13↵{\"watch\":{\"path\":\"/org/projectatomic/rpmostree1/Sysroot\",\"interface\":\"org.projectatomic.rpmostree1.Sysroot\"},\"id\":\"2\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"superuser\":\"try\",\"payload\":\"dbus-json3\",\"name\":\"org.freedesktop.hostname1\",\"command\":\"open\",\"channel\":\"14\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "14↵{\"add-match\":{\"path\":\"/org/freedesktop/hostname1\",\"interface\":\"org.freedesktop.hostname1\"}}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "14↵{\"watch\":{\"path\":\"/org/freedesktop/hostname1\",\"interface\":\"org.freedesktop.hostname1\"},\"id\":\"2\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"metrics1\",\"interval\":1000,\"source\":\"pcp-archive\",\"metrics\":[{\"name\":\"mem.util.used\",\"units\":\"bytes\"}],\"timestamp\":-300470,\"limi…" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"metrics1\",\"interval\":1000,\"source\":\"pcp-archive\",\"metrics\":[{\"name\":\"network.interface.total.bytes\",\"units\":\"bytes\",\"derive\":\"r…" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"metrics1\",\"interval\":1000,\"source\":\"pcp-archive\",\"metrics\":[{\"name\":\"disk.all.total_bytes\",\"units\":\"bytes\",\"derive\":\"rate\"}],\"t…" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"stream\",\"spawn\":[\"cat\",\"/proc/meminfo\",\"/proc/cpuinfo\"],\"command\":\"open\",\"channel\":\"18\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"stream\",\"spawn\":[\"grep\",\"-r\",\".\"],\"directory\":\"/sys/class/dmi/id\",\"err\":\"ignore\",\"superuser\":\"try\",\"command\":\"open\",\"channel\":\"…" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"stream\",\"spawn\":[\"hostname\"],\"err\":\"ignore\",\"command\":\"open\",\"channel\":\"20\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"bus\":\"system\",\"payload\":\"dbus-json3\",\"name\":\"org.freedesktop.realmd\",\"command\":\"open\",\"channel\":\"21\",\"flow-control\":true}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "21↵{\"watch\":{\"path\":\"/org/freedesktop/realmd\"},\"id\":\"1\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "21↵{\"add-match\":{\"interface\":\"org.freedesktop.realmd.Realm\",\"path_namespace\":\"/\"}}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "21↵{\"watch\":{\"interface\":\"org.freedesktop.realmd.Realm\",\"path_namespace\":\"/\"},\"id\":\"2\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"metrics1\",\"interval\":1000,\"source\":\"direct\",\"metrics\":[{\"name\":\"mem.util.used\",\"units\":\"bytes\"}],\"command\":\"open\",\"channel\":\"22…" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"metrics1\",\"interval\":1000,\"source\":\"direct\",\"metrics\":[{\"name\":\"disk.all.total_bytes\",\"units\":\"bytes\",\"derive\":\"rate\"}],\"comman…" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "↵{\"payload\":\"metrics1\",\"interval\":1000,\"source\":\"direct\",\"metrics\":[{\"name\":\"network.interface.total.bytes\",\"units\":\"bytes\",\"derive\":\"rate\"}…" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"3\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"4\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"5\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"6\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"7\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"8\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"9\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"10\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"11\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"12\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"13\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"14\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"15\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"16\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"17\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"18\"}" (cockpit.js, line 442)
[Log] transport closed, dropped message:  – "7↵{\"call\":[\"/org/freedesktop/timedate1\",\"org.freedesktop.DBus.Properties\",\"Get\",[\"org.freedesktop.timedate1\",\"NTPSynchronized\"]],\"id\":\"19\"}" (cockpit.js, line 442)

[hfoy]

Hi @martinpitt and @leomoty I tested some more and from my testing the following does not work:

• Safari on iOS 11.4.1, 12, 12.1 (16B5059d) all these versions throw similar errors which @leomoty posted above.
• Chrome (69.0.3497.105) on iOS 12 and 12.1 (I am unable to debug this one)

(Tested on iPad Mini 2 and iPhone 7 Plus)

However, both 172 and 178 works flawlessly when running macOS Mojave (10.14) with Safari 12.0 (14606.1.36.1.9).

[leomoty]

@martinpitt, any updates? I can help testing if needed.

[martinpitt]

Sorry, no, please don't expect any action from me here. I don't have any Apple hardware, and it's not clear at all what exactly happens/fails here.

[garrett]

I'd love for Cockpit to have proper iOS support, but can't help outside of WebKit fixes. (@larskarlitski and I both test Cockpit in WebKit periodically and make fixes when needed.)

I only have a MacBook Pro 5,3 from mid-2009 running OS X (macOS isn't available for it) and an iPad 1 (which is basically slightly more useful than a paperweight), so I can't really help out much.

FWIW: Every browser on iOS is WebKit. All non-Safari browsers are forced to use the same exact engine, including "Firefox". I'd suggest using the one with the best debugging tools, which is probably Safari.

[xkalibur]

I was able to make it work on iPad by setting AllowUnencrypted=true and using http. Presumably setting up a proper cert would work, too. I’m only using this over my home lan for now. Found a similar issue (regarding cockpit on iOS) via google circa 2016, that mentioned possible web socket issues with untrusted certs which led to this workaround.

[leomoty]

Since @xkalibur said that allowing unecrypted works, I am doing the opposite, I have a valid certificate for my cockpit instance. And I can confirm it works properly. Last time when I tried, I just used the raw ip (lazy).

[Bellusterra]

I was having the same issue with everything working fine over laptop/desktop but would get a white screen after logging in over mobile. I have a setup similar to this one:
https://github.com/cockpit-project/cockpit/wiki/Proxying-Cockpit-over-NGINX

And found that changing the lines:
proxy_pass http://websocket;
proxy_set_header Origin http://$host;
TO:
proxy_pass https://websocket;
proxy_set_header Origin https://$host;

Fixed the issue on iOS.
Hope that helps someone.

[garrett]

So I got an iPhone 7 today for testing purposes and can reproduce this error.

I hooked it up to my very old MacBook Pro and managed to see the console log:

[garrett]

There's a possible fix mentioned at https://stackoverflow.com/a/39932753:

I have this issue, too. Node https + express + socket.io, my web page is working fine on desktop safari, but not on mobile safari.

After stop grabbing and trying, I found the problem is "certificate chain". https://stackoverflow.com/a/20444809/6939828

I'm using TWCA's ssl certification, after inject "ca: chain.cer" into options to https.createServer, same page same code just works on mobile safari. Hurray!

I don't know what it means though, as I don't have a clue about certificates or self-signed certs — aside from the fact that they exist and are needed for a secure connection. Perhaps @mvollmer, @martinpitt, @larskarlitski might know?

[leomoty]

Hey @garrett, I guess it is mostly a configuration issue. You can either issue a valid cert, like I did with Lets Encrypt. Or what @xkalibur did by allowing unencrypted connections. The latter is defined here:

https://cockpit-project.org/guide/149/cockpit.conf.5.html

AllowUnencrypted | If true, cockpit will accept unencrypted HTTP connections. Otherwise, it redirects all HTTP connections to HTTPS. Exceptions are connections from localhost and for certain URLs (like /ping). Defaults to false.
-- | --

[grregis]

I was having a similar issue. I run docker on my server and my web server is run through a contatiner while I have cockpit on the main system. I also am using LetsEncrypt for certificates as well.

First, I transfered my LetsEncrypt cert to cockpit

cat /etc/letsencrypt/live/cockpit.yoursite.com/fullchain.pem >> /etc/cockpit/ws-certs.d/1-my-cert.cert
cat /etc/letsencrypt/live/cockpit.yoursite.com/privkey.pem >> /etc/cockpit/ws-certs.d/1-my-cert.cert

I will be setting up a cron job to do this when I update my certs with LetsEncrypt.

I also changed my /etc/cockpit/config.conf to the following

[WebService]
AllowUnencrypted = true
Origins = https://cockpit.yoursite.com http://10.0.0.2:9090
ProtocolHeader = X-Forwarded-Proto

And here is my Apache conf

<IfModule mod_ssl.c>
<VirtualHost *:443>

ServerAdmin [email protected]
ServerName cockpit.yoursite.com
ServerAlias www.cockpit.yoursite.com
DocumentRoot /var/www/html

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

ProxyPreserveHost On

  RewriteEngine On
  RewriteCond %{HTTP:Upgrade} =websocket [NC]
  RewriteRule /(.*)           ws://10.0.0.2:9090/$1 [P,L]
  RewriteCond %{HTTP:Upgrade} !=websocket [NC]
  RewriteRule /(.*)           http://10.0.0.2:9090/$1 [P,L]

    <Proxy *>
        Order allow,deny
        Allow from all
    </Proxy>
ProxyPass / http://10.0.0.2:9090/
ProxyPassReverse / http://10.0.0.2:9090/

        RequestHeader set X-Forwarded-Proto "https"
        RequestHeader set X-Forwarded-Port "443"

SSLCertificateFile /etc/letsencrypt/live/cockpit.yoursite.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cockpit.yoursite.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

Like I said, my webserver is on a docker container so the 10.0.0.2 is the local IP for server. If you have both on the same machine you can probably substitute it for localhost. Like this, I can (only) log in via http on the local network, but am forced to use https when outside and using cockpit.yoursite.com.

[garrett]

We do have an error message with an installable certificate for Safari iOS now: https://github.com/cockpit-project/cockpit/pull/12493

However, you have to jump through hoops to "install" it into iOS. And then, at least for me on iOS 13 Beta 3, it doesn't work. :cry:

I don't know if there's much else we can do. I'll try again on iOS 13 beta 4. (Perhaps Apple might finally fix the issue for iOS someday? They fixed this same exact issue for macOS last year.)

[iandk]

Any news?

[garrett]

@iandk: Yep, previous comment. However, while we got it working on the iOS simulator, I wasn't able to get this work-around working on iOS 13 on an actual iPhone.

This is a bug with Apple; we cannot fix this, only work around it.

The most proper solution is to use a valid certificate instead of attempting to use a self-signed one. Using a valid, non-self-signed certificate works without any workarounds.

Meanwhile, we now have a page that at least states the error and links to the certificate. (You have to have already accepted the certificate to see it. This is mainly for iOS, where websockets don't work on self-signed certs until installed into the system keystore manually.)

FWIW: I've tried again on iOS 13 release and it didn't work for me. The phone is now on iOS 13.1 and I'm about to update it to the 13.2 beta to see if they fixed it there finally. (I'm assuming no, as this issue has been on their end for several years now. At least they did finally fix it in macOS a year or so ago. However, macOS has the possibility of having browsers that aren't Safari. iPhones and iPads can only use one browser, Safari, so we're 100% at Apple's mercy here.)

[garrett]

FWIW, the problem has been around for at least a decade... https://bugs.webkit.org/show_bug.cgi?id=41419 (and this one is about minimally _logging_ that it doesn't work). This WebKit Bugzilla bug is a little more relevant: https://bugs.webkit.org/show_bug.cgi?id=145819

It has been fixed in all implementations of WebKit I've seen except for iOS / iPadOS. (That is, Apple finally fixed it in Safari macOS around a year ago and it has been fixed in open source WebKit browsers such as Epiphany as a result too.)

Meanwhile, I tested the certificate again in iOS 13.2 beta here and it still doesn't work. It's frustrating, and there's not much more we can do from our end. (Several of us on the team have spent many hours trying to get this to work.)

[mikey32230]

I've been trying to read through and follow this Issue thread. I see there are 2 workaround solutions:

• Allowing unencrypted connections via /etc/cockpit/cockpit.conf as stated by @xkalibur
• Issue a valid cert (e.g. Lets Encrypt), place in /etc/cockpit/ws-certs.d/ @leomoty

So I have a couple questions:

1. I assume the cert still won't work for accessing via internal ip or internal hostname?

2. I'm failing to understand why this white screen issue is only really happening with cockpit, compared to other self-hosted web applications run over https without a valid cert? (e.g. shown the this connection is not private warning and continuing anyway.)

[martinpitt]

@mikey32230 : "Normal" https connections work with the certificate warning. The bug in Safari is that this "get me there anyway" override does not apply to websockets. So you can still see Cockpit's login page (which doesn't use websocket), but after login it fails because the cockpit protocol runs over websocket.

[leomoty]

@mikey32230 I do actually put my cockpit behind a reverse proxy (traefik), which is only available within the network.

To validate my claim to the domain I just use the DNS challenge method from Lets Encrypt (this is handled automatically by Traefik, just need configuration), so the application doesn't need external access.

I also set a DNS rule to say something like "cockpit.example.com" -> "internal ip".

[mikey32230]

@martinpitt Thanks for the simple explanation, that makes sense. I've now gone and googled a bit about websockets, never really understood that before. Nice to learn something new.

@leomoty Thank you for the further explanation. I have a similar setup to you with nginx as my reverse proxy server + letsencrypt in a docker container, although I don't have a need to reverse proxy cockpit.

If you request a valid cert I understand that accessing the site via domain name (e.g. https://cockpit.example.com) should work.
But that cert will still be invalid if you access the site directly at its internal ip (E.g. https://10.0.0.2:9090), right?

[leomoty]

@mikey32230 yeah, you'd need to place the cert in cockpit directly for that case.

[dld-r00f]

Nginx proxy with client certificate also does not work on iOS Safari. (server certificate from Lets Encrypt and client certificate with self signed CA installed on ios) The login page is fine, but WSS does not work at all.

[andrew-kennedy]

I'm also having issues with a self-signed client mTLS cert on iOS and macOS Safari. I cannot get cockpit to load with my reverse proxy forwarding to cockpit after accepting requests with mTLS. Login page works, WSS doesn't work, I get the error page telling me to check journalctl -u cockpit, and to install the self-signed cert. However, the self signed cert doesn't fix anything, and there are no messages in journalctl. Have to disable the reverse proxy mTLS usage to make cockpit work in iOS or macOS Safari. No issues with Chrome on macOS though.

[garrett]

iOS Safari's websocket implementation doesn't work with self-signed certificates. macOS does.

OS X WebKit has supported self-signed certificates with websocket for years now. Plus, on OS X / macOS, you can install other browsers, unlike on iOS. Unfortunately, there's only one browser available on iOS — Safari. (All other "browsers" are just custom shells around Safari WebKit.)

There's nothing at all we can do to fix iOS. We've tried everything, and so have other projects. It's 100% an Apple iOS issue (and has been since the iPhone has come out). We're all at the mercy of the Apple iOS WebKit developers here, as there's no choice on iOS.

I'm updating my test iPhone to iOS 14 beta, which has changed a lot of WebKit specifically. Hopefully they've finally fixed this bug. I'll report back if they have or have not.

Meanwhile, if you want iOS support with Cockpit (or anything else that requires websocket support), you have four options:

1. Run over HTTP. (Not ideal whatsoever, and we do not suggest doing this, for obvious reasons.)
2. Use a proper certificate from a CA. (Not always possible.)
3. Use Android or a desktop OS, where it works. (Not always possible.)
4. Wait and hope for Apple to finally fix their longstanding bug.

[garrett]

That all said, you shouldn't be getting a black screen on any browser. We changed Cockpit a while back to show an error message.

What version of Cockpit are you using?

[garrett]

Update: iOS14 WebKit's websocket _still_ does not work with self-signed certificates. :cry:

[garrett]

@andrew-kennedy FWIW: macOS Safari _should_ still work with self-signed certs, unless Apple had a regression in the latest version of macOS. (I've tested the previous version on my old MacBook and it worked fine. It also worked fine in the latest few versions OS X.)

[garrett]

Note:

1. Use a proper certificate from a CA. (Not always possible.)

You can use a letsencrypt cert if your host is Internet-facing. Otherwise, you _should_ also be able to use a companywide cert, if it is a legitimate certificate (and not a self-signed one).

This is really the only proper solution I'm aware of, aside from Apple fixing their issues.

[leomoty]

@garrett I've used letsencrypt on my local network with success, you just need to use DNS challenge instead of HTTP one to reverify the certificate. Keep in mind, I am using a load balancer (Traefik) that autorenews it.

[andrew-kennedy]

That all said, you shouldn't be getting a black screen on any browser. We changed Cockpit a while back to show an error message.

What version of Cockpit are you using?

I do indeed get an error message, and I'm using cockpit version 223 on fedora 32. Strangely though you claim macOS Safari does not have the websocket bug, I do get the same error screen as iOS. I'm on macOS version 10.15.5, perhaps there's been a regression.

I can try to get a proper cert from letsencrypt in cockpit in addition to my letsencrypt cert for my reverse proxy at the domain I host cockpit at. For what it's worth I have no issues if I turn off mTLS but I just didn't want to expose cockpit to the public internet.

[andrew-kennedy]

Just opened the javascript console on macOS safari, and I get WebSocket network error: The operation couldn’t be completed. (OSStatus error -9825.), which according to OSStatus.com translates to errSSLPeerBadCert. I'm guessing it's a regression in desktop Safari.

[garrett]

Apple fixed it in Mac OS X years ago (before the rename to macOS).

I just confirmed that Cockpit works with a self-signed certificate on macOS Safari 10.15.3 (I need to update this test box). So, if it is a regression, then it would be either in .4 or .5. Otherwise, it might not like your certificate for other reasons. I don't have a proxy in the middle, for example. This is simply Cockpit and its own autogenerated self-signed certificate.

Safari on macOS is definitely pickier than other browsers when it comes to certificates, but it's not nearly as picky as iOS.