Subject: [hybi] Client certificate authentication for WSS websockets using twisted and autobahn

From: Marc Mühlbauer <[email-masked]>
Date: Mon, 13 May 2013 11:17:28 +0200

Dear subscribers,

I'm currently facing an issue while implementing client certificate
authentication for the use of secure websockets using the twisted and
autobahn python libraries.

Following the instructions of Tobias Oberstein, the CEO of tavendo which
hosts the autobahn library, I managed to get the authentication working in
the IE 10 ( at
http://stackoverflow.com/questions/16234429/how-can-i-setup-an-autobahn-pub-sub-server-and-a-autobahn-webserver-listening-onyou
can see the conversation and part of my source code).

The problem seems to be, as far as I can tell, that the security context of
the SSL session is not used for the access to the websocket. In other
words: If I authenticate with a client certificate to retrieve the page
running on https://, Firefox and Chrome don't ask me again to authenticate
for the use of the secure websocket and also dont use the recent
authentication for that. This means, the client is not authenticated and
hence isnt allowed to use the websocket.

In IE 10, it works as intended.

Now I'm curious if this has something to do with the different browser
behaviour or the root cause of the problem can be found on server side.
Note that webserver and websocket are running on the same port. For test
purposes, the whole thing runs only locally on localhost:9000 and I'm using
self signed certificates.

Any advice would be really nice!

If you guys need further information, please let me know.

Thanks in advance!

Greetings, Marc

---

From: Takeshi Yoshino <[email-masked]>
Date: Tue, 14 May 2013 17:55:49 +0900

On Mon, May 13, 2013 at 6:17 PM, Marc Mühlbauer <
[email-masked]> wrote:

> http://stackoverflow.com/questions/16234429/how-can-i-setup-an-autobahn-pub-sub-server-and-a-autobahn-webserver-listening-onyou can see the conversation and part of my source code).
>
> The problem seems to be, as far as I can tell, that the security context
> of the SSL session is not used for the access to the websocket. In other
> running on https://, Firefox and Chrome don't ask me again to
> authenticate for the use of the secure websocket and also dont use the
> recent authentication for that. This means, the client is not authenticated
> and hence isnt allowed to use the websocket.
>

Chrome does support wss client authentication using a certificate. We don't
show any prompt but just use the cached info for that host.

Can you get any debug information from your server about the TLS
negotiation? As it's not clear if it's related to the spec or just an issue
with Chrome, please file a bug at crbug.com and let's discuss there.

> self signed certificates.

Using self signed one should be fine.