[hybi] Client certificate authentication for WSS websockets using twisted and autobahn

[Marc Mühlbauer <[e-mail]>]

Dear subscribers,

I'm currently facing an issue while implementing client certificate
authentication for the use of secure websockets using the twisted and
autobahn python libraries.

Following the instructions of Tobias Oberstein, the CEO of tavendo which
hosts the autobahn library, I managed to get the authentication working in
the IE 10 ( at
http://stackoverflow.com/questions/16234429/how-can-i-setup-an-autobahn-pub-sub-server-and-a-autobahn-webserver-listening-onyou
can see the conversation and part of my source code).

The problem seems to be, as far as I can tell, that the security context of
the SSL session is not used for the access to the websocket. In other
words: If I authenticate with a client certificate to retrieve the page
running on https://, Firefox and Chrome don't ask me again to authenticate
for the use of the secure websocket and also dont use the recent
authentication for that. This means, the client is not authenticated and
hence isnt allowed to use the websocket.

In IE 10, it works as intended.

Now I'm curious if this has something to do with the different browser
behaviour or the root cause of the problem can be found on server side.
Note that webserver and websocket are running on the same port. For test
purposes, the whole thing runs only locally on localhost:9000 and I'm using
self signed certificates.

Any advice would be really nice!

If you guys need further information, please let me know.

Thanks in advance!

Greetings, Marc