Shadow-cljs: Allowing auto-reload over https

[iku000888]

Sorry for throwing in multiple issues in a row.

I work on a project that requires the JavaScript being developed to be served over https.
However, the shadow-cljs worker delivers the code reload over http and results in a mixed content error as follows.

main.js:37794 Mixed Content: The page at 'https://localhost:9443/shadow-test.html' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://localhost:42824/worker/files/urikake-test/1654ca23-4e3d-47ea-bc9e-6d140afde3aa/4f74fc31-ef91-4e0f-b654-76c2ce3392df'. This request has been blocked; the content must be served over HTTPS.

It would be great if this can be done over https.
At a glance shadow-cljs seems to use aleph internally, which in turn seems to support ssl, but not sure about the feasibility beyond that.

[thheller]

Adding SSL is simple, the only real issue is that you need a certificate+private key.

Do you have access to the certificate that serves the HTML/JS? If yes I could add a configuration option to use that. Generating self-signed certificate is a bit painful but could also be done. It just can't be in the git repo but must be done by the user.

[iku000888]

I have unsigned keypairs/know how to generate them so such configuration option would be awesome!

Would java keystores also work?
If one has java installed getting a self signed cert/key pair is easy as:
keytool -keystore keystore -alias jetty -genkey -keyalg RSA

Seems like the underlying netty(not sure aleph does) can use java keystores, so I thought it might be worth considering.
https://maxrohde.com/2013/09/07/setting-up-ssl-with-netty/

I do not have any preference fore java keystores so if cert/private key is much easier to set up, that would be really helpful :)

[thheller]

It has been a while since I messed with SSL in Java but I still have some code running somewhere that does what I need. I'll look into it.

[iku000888]

@thheller Thanks!

shadow-cljs is already better as-is than any tooling available out there for my particular use case(with constraints like this), so no pressure!

[thheller]

In [email protected] I added basic support for SSL.

The setup is quite complicated and currently its a global setting. It will be used for ALL http/websocket traffic once enabled.

Configure at the top level of shadow-cljs.edn:

{:dependencies [...]
 :ssl {:keystore "ssl/keystore.jks"
         :password "shadow-cljs"}

:keystore is the path to a java keystore created by keytool. :password is the required password to access that keystore. Just setting :ssl {} will use the settings above.

[thheller]

OSX Instructions for getting a self-signed cert:

Some instructions are available at https://certsimple.com/blog/localhost-ssl-fix but its not quite up to date and we need to do a few things differently.

open /Applications/Utilities/Keychain\ Access.app/

From the menu:

Keychain Access -> Certificated Assistant -> Create a Certificate

Name: must be localhost or whatever host you are going to use.

Certificate Type: SSL Server

Click Let me override defaults.

Click through till "Subject Alternative Name (SAN)", add URI localhost, dnsName localhost, remove IP.

When done trust the Cert via Get Info. Then Export with the :password you are going to use. You must use a password.

You end up with a Certificates.p12 file which we can now turn into the keystore.jks we need.

keytool -importkeystore -destkeystore keystore.jks -srcstoretype PKCS12 -srckeystore Certificates.p12

Enter the password a bunch of times and that should be it.

[iku000888]

Wow, thanks!

On Fri, Nov 10, 2017 at 10:17 PM, Thomas Heller [e-mail]
wrote:

OSX Instructions for getting a self-signed cert:

Some instructions are available at https://certsimple.com/blog/
localhost-ssl-fix but its not quite up to date and we need to do a few
things differently.

open /Applications/Utilities/Keychain\ Access.app/

From the menu:

Keychain Access -> Certificated Assistant -> Create a Certificate

Name: must be localhost or whatever host you are going to use.

Certificate Type: SSL Server

Click Let me override defaults.

Click through till "Subject Alternative Name (SAN)", add URI localhost,
dnsName localhost, remove IP.

When done trust the Cert via Get Info. Then Export with the :password you
are going to use. You must use a password.

You end up with a Certificates.p12 file which we can now turn into the
keystore.jks we need.

keytool -importkeystore -destkeystore keystore.jks -srcstoretype PKCS12 -srckeystore Certificates.p12

Enter the password a bunch of times and that should be it.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/thheller/shadow-cljs/issues/88#issuecomment-343470850,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AK8iUSXfiqhMvwvd1n60tY1N1UnY-wRnks5s1Ez6gaJpZM4O51rT
.

[thheller]

This needs more documentation but ssl+http2 works pretty reliablly once you have a valid cert.

https://shadow-cljs.github.io/docs/UsersGuide.html#_ssl