Re: [hybi] Client certificate authentication for WSS websockets using twisted and autobahn

[Takeshi Yoshino <[e-mail]>]

On Mon, May 13, 2013 at 6:17 PM, Marc Mühlbauer <
[e-mail]> wrote:

> I'm currently facing an issue while implementing client certificate
> authentication for the use of secure websockets using the twisted and
> autobahn python libraries.
>
> Following the instructions of Tobias Oberstein, the CEO of tavendo which
> hosts the autobahn library, I managed to get the authentication working in
> the IE 10 ( at
> http://stackoverflow.com/questions/16234429/how-can-i-setup-an-autobahn-pub-sub-server-and-a-autobahn-webserver-listening-onyou can see the conversation and part of my source code).
>
> The problem seems to be, as far as I can tell, that the security context
> of the SSL session is not used for the access to the websocket. In other
> words: If I authenticate with a client certificate to retrieve the page
> running on https://, Firefox and Chrome don't ask me again to
> authenticate for the use of the secure websocket and also dont use the
> recent authentication for that. This means, the client is not authenticated
> and hence isnt allowed to use the websocket.
>

Chrome does support wss client authentication using a certificate. We don't
show any prompt but just use the cached info for that host.

Can you get any debug information from your server about the TLS
negotiation? As it's not clear if it's related to the spec or just an issue
with Chrome, please file a bug at crbug.com and let's discuss there.


> In IE 10, it works as intended.
>
> Now I'm curious if this has something to do with the different browser
> behaviour or the root cause of the problem can be found on server side.
> Note that webserver and websocket are running on the same port. For test
> purposes, the whole thing runs only locally on localhost:9000 and I'm using
> self signed certificates.
>

Using self signed one should be fine.