Is it possible to use SSL certificates with Websocket protocol?

[tukusejssirs]

I want to use WSS protocol, so I added the contents of the certificates to the options of aedes-server-factory.createServer(), however, while it still executes, I cannot connect to the broker using wss://$ip:4000, but I only with ws://$ip:4000.

Is it possible to force using SSL certificates with MQTT over WS?

const {readFileSync} = require('node:fs')

const aedesImport = require('aedes')
const cluster = require('cluster')
const mongoPersistence = require('aedes-persistence-mongodb')
const mqemitter = require('mqemitter-mongodb')
const {createServer} = require('aedes-server-factory')

const config = {
  cluster: {
    number: 3
  },
  mongo: {
    url: 'mongodb://mongo:27017/aedes_wss'
  },
  server: {
    options: {
      cert: readFileSync('cert.crt'),
      key: readFileSync('cert.key'),
      ws: true
    },
    port: 4000
  }
}

var totalClientsNumber = 0
var clientsNumberPerBroker = Array(config.cluster.number).fill(0)
var totalSubscriptionsNumber = 0
var subscriptionsNumberPerBroker = Array(config.cluster.number).fill(0)

if (cluster.isMaster) {
  for (let i = 0; i < config.cluster.number; i++) {
    cluster.fork()
  }

  cluster.on('online', worker => {
    console.log(`Worker ${worker.id} [PID ${worker.process.pid}] is online`)
  })

  cluster.on('exit', (worker, code, signal) => {
    console.log(`Starting a new worker, because worker ${worker.id} [PID ${worker.process.pid}] died with code: ${code}, and signal: ${signal}`)
    cluster.fork()
  })
} else {
  startAedes()
}

function startAedes() {
  const aedes = aedesImport({
    id: `broker_${cluster.worker.id}`,
    mq: mqemitter({
      url: config.mongo.url
    }),
    persistence: mongoPersistence({
      ttl: {
        packets: 300,
        subscriptions: 300
      },
      url: config.mongo.url
    })
  })

  const server = createServer(aedes, config.server.options)

  server.listen(config.server.port, () => {
    console.log(`Broker ${aedes.id} listening on port ${config.server.port}`)
  })

  aedes.on('subscribe', (subscriptions, client) => {
    const brokerIdx = +aedes.id.match(/\d+$/g)[0] - 1
    totalSubscriptionsNumber++
    subscriptionsNumberPerBroker[brokerIdx]++
    console.log(`[${subscriptionsNumberPerBroker[brokerIdx]}/${totalSubscriptionsNumber}] MQTT client ${client ? client.id : client} subscribed to topic(s): ${subscriptions.map(s => s.topic).join('\n')} on broker ${aedes.id}`)
  })

  aedes.on('unsubscribe', (subscriptions, client) => {
    const brokerIdx = +aedes.id.match(/\d+$/g)[0] - 1
    totalSubscriptionsNumber--
    subscriptionsNumberPerBroker[brokerIdx]--
    console.log(`[${subscriptionsNumberPerBroker[brokerIdx]}/${totalSubscriptionsNumber}] MQTT client ${client ? client.id : client} unsubscribed from topic(s): ${subscriptions.join('\n')} on broker ${aedes.id}`)
  })

  aedes.on('client', client => {
    const brokerIdx = +aedes.id.match(/\d+$/g)[0] - 1
    totalClientsNumber++
    clientsNumberPerBroker[brokerIdx]++
    console.log(`[${clientsNumberPerBroker[brokerIdx]}/${totalClientsNumber}] Client connected: ${client ? client.id : client} to broker ${aedes.id}`)
  })

  aedes.on('clientDisconnect', client => {
    const brokerIdx = +aedes.id.match(/\d+$/g)[0] - 1
    totalClientsNumber--
    clientsNumberPerBroker[brokerIdx]--
    console.log(`[${clientsNumberPerBroker[brokerIdx]}/${totalClientsNumber}] Client disconnected: ${client ? client.id : client} from broker ${aedes.id}`)
  })
}

[robertsLando]

wss require https, you have to also set the https options with key/cert and set the ws flag to true https://github.com/moscajs/aedes-server-factory/blob/main/index.js#L61

[getlarge]

Hi @tukusejssirs, when trustProxy is set to true, it indicates that you trust what was added by the proxy (server) via the PROXY protocol added to the original buffer (which make PROXY protocol + MQTT packet if you prefer).
Under the hood this will allow to execute the protocolDecoder function which makes use of aedes-protocol-décoder exported function of the same name by default (and can be overridden via the options passed to the factory).
If set to false it will run extractSocketDetails that can also be overridden via the options and will per default use the same function from aedes-protocol-décoder.

See this part of the code.

[tukusejssirs]

Thanks, @getlarge! 🙏

I have read the code you shared (actually, @robertsLando already shared that file with me and that is why I wanted to understand whether I need/want to use trustProxy or not). Therefore, I still have no idea whether I need/want to use trustProxy or not.

That said, I have a simple use case to deal with and I actually don’t to understand it much deeper. All I need to to be able to create a MQTT over WSS broker which I will run in a Docker container. Than I use Nginx to proxy the connection to a path (e.g. /mqtt). All this works without SSL certificates, however, now I want to be able to connect to the broker via wss://$mqtt_ws_container_ip:4000 which will be proxied to https://$host_ip:443/mqtt.

Below is my code that I created based on what @robertsLando told me in his previous comment. Note that I used trustProxy = false and removed unused code. But I was not able to connect to the broker, neither using ws:// nor wss://, neither using localhost nor 127.0.0.1 (I used mqtt and connect('$prot://$ip:$port')).

MQTT over WSS

const cluster = require('node:cluster')
const {readFileSync} = require('node:fs')
const {createServer} = require('node:tls')

const aedesImport = require('aedes')
const mongoPersistence = require('aedes-persistence-mongodb')
const mqemitter = require('mqemitter-mongodb')
const ws = require('ws')
const {extractSocketDetails} = require("aedes-protocol-decoder");

const certPath = '/etc/ssl/private'
const certificates = {}

try {
  certificates.cert = readFileSync(`${certPath}/cert.crt`)
} catch (e) {
  console.error(`[ERROR] Failed to read 'cert.crt' file. Please generate SSL certificates in order to proceed.`)
  process.exit(2)
}

try {
  certificates.key = readFileSync(`${certPath}/cert.key`)
} catch (e) {
  console.error(`[ERROR] Failed to read 'cert.key' file. Please generate SSL certificates in order to proceed.`)
  process.exit(3)
}

const config = {
  aedesOptions: {
    ws: true
  },
  cluster: {
    number: 3
  },
  mongo: {
    url: 'mongodb://mongo:27017/aedes_ws'
  },
  port: 4000,
  tlsOptions: certificates
}

var totalClientsNumber = 0
var clientsNumberPerBroker = Array(config.cluster.number).fill(0)
var totalSubscriptionsNumber = 0
var subscriptionsNumberPerBroker = Array(config.cluster.number).fill(0)

if (cluster.isMaster) {
  for (let i = 0; i < config.cluster.number; i++) {
    cluster.fork()
  }

  cluster.on('online', worker => {
    console.log(`Worker ${worker.id} [PID ${worker.process.pid}] is online`)
  })

  cluster.on('exit', (worker, code, signal) => {
    console.log(`Starting a new worker, because worker ${worker.id} [PID ${worker.process.pid}] died with code: ${code}, and signal: ${signal}`)
    cluster.fork()
  })
} else {
  startAedes()
}

function startAedes() {
  const aedes = aedesImport({
    id: `broker_${cluster.worker.id}`,
    mq: mqemitter(config.mongo),
    persistence: mongoPersistence({
      ttl: {
        packets: 300,
        subscriptions: 300
      },
      url: config.mongo.url
    })
  })

  const bindConnection = (aedes, conn, req = {}) => {
    req.connDetails = extractSocketDetails(conn.socket || conn)
    aedes.handle(conn, req)
  }

  const server = createServer(config.tlsOptions, aedes.handle)

  const socket = new ws.Server({server})
  socket.on('error', () => {})  // FIXME: Add a real cb.
  socket.on('connection', (conn, req) => {
    const stream = ws.createWebSocketStream(conn)
    // the _socket object is needed in bindConnection to retrieve info from the stream
    // before passing it to aedes.handle
    stream._socket = conn._socket
    bindConnection(aedes, stream, req)
  })

  server.listen(config.port, () => {
    console.log(`Broker ${aedes.id} listening on port ${config.port}`)
  })

  aedes.on('subscribe', (subscriptions, client) => {
    const brokerIdx = +aedes.id.match(/\d+$/g)[0] - 1
    totalSubscriptionsNumber++
    subscriptionsNumberPerBroker[brokerIdx]++
    console.log(`[${subscriptionsNumberPerBroker[brokerIdx]}/${totalSubscriptionsNumber}] MQTT client ${client ? client.id : client} subscribed to topic(s): ${subscriptions.map(s => s.topic).join('\n')} on broker ${aedes.id}`)
  })

  aedes.on('unsubscribe', (subscriptions, client) => {
    const brokerIdx = +aedes.id.match(/\d+$/g)[0] - 1
    totalSubscriptionsNumber--
    subscriptionsNumberPerBroker[brokerIdx]--
    console.log(`[${subscriptionsNumberPerBroker[brokerIdx]}/${totalSubscriptionsNumber}] MQTT client ${client ? client.id : client} unsubscribed from topic(s): ${subscriptions.join('\n')} on broker ${aedes.id}`)
  })

  aedes.on('client', client => {
    const brokerIdx = +aedes.id.match(/\d+$/g)[0] - 1
    totalClientsNumber++
    clientsNumberPerBroker[brokerIdx]++
    console.log(`[${clientsNumberPerBroker[brokerIdx]}/${totalClientsNumber}] Client connected: ${client ? client.id : client} to broker ${aedes.id}`)
  })

  aedes.on('clientDisconnect', client => {
    const brokerIdx = +aedes.id.match(/\d+$/g)[0] - 1
    totalClientsNumber--
    clientsNumberPerBroker[brokerIdx]--
    console.log(`[${clientsNumberPerBroker[brokerIdx]}/${totalClientsNumber}] Client disconnected: ${client ? client.id : client} from broker ${aedes.id}`)
  })
}

[getlarge]

trustProxy is useful to automatically parse some data added by the proxy and retrieve the IP from the “real” client and not the one from the proxy.
For TCP or TLS connections it will parse the Proxy protocol and for HTTP (used by Websockets) it will parse the headers to retrieve the IP from x-forwarded-for or x-real-ip which are common headers to add the client IP in proxies.
The information retrieved will be added to req.connDetails and will then be made available under client.connDetails.
So the question you need to answer for yourself is, do you need more accurate connection information in your use case?

As for the connection not working, you I cannot tell you why.
Maybe it is an issue in you docker config / network?
Did you check port mapping?
Can the host be accessed by your proxy?
Is the TLS config valid?
You might want to check your broker and Nginx logs .

[tukusejssirs]

Thanks for the explanation regarding trustProxy. 🙏

Maybe it is an issue in you docker config / network?

I have tested the script locally, outside Docker and Nginx. Even the MQTT client was running on the same host outside Docker and Nginx. After I get this working locally, I’ll move this to Docker and behind Nginx proxy.

Is the TLS config valid?

Well, I have configured only the certificates and those are existing and valid. Do I need something else to condigure?

[tukusejssirs]

Guys, I have simplified my previous code and removed the clusters and Mongo, therefore it should be the simplest possible code to create MQTT broker over WSS. Still, I cannot connect to it when I run it locally (directly on the host, not in a Docker container) using mqtt client (be it with ws:// or ws:// protocols, be it with localhost or 127.0.0.1). I have also added the code how I try to connect to the broker from Node.

I must be overlooking something trivial. Thanks, guys, for helping me out! 🙏

MQTT broker over WSS

const {readFileSync} = require('node:fs')
const {createServer} = require('node:tls')

const aedesImport = require('aedes')
const {extractSocketDetails} = require('aedes-protocol-decoder')
const ws = require('ws')

const certPath = '/etc/ssl/private'
const certificates = {}

try {
  certificates.cert = readFileSync(`${certPath}/controlserver.crt`)
} catch (e) {
  console.error(`[ERROR] Failed to read 'controlserver.crt' file. Please generate SSL certificates in order to proceed.`)
  process.exit(2)
}

try {
  certificates.key = readFileSync(`${certPath}/controlserver.key`)
} catch (e) {
  console.error(`[ERROR] Failed to read 'controlserver.key' file. Please generate SSL certificates in order to proceed.`)
  process.exit(3)
}

const config = {
  aedesOptions: {
    ws: true
  },
  port: 4000,
  tlsOptions: certificates
}

const aedes = aedesImport({
  id: 'broker'
})

const bindConnection = (aedes, conn, req = {}) => {
  req.connDetails = extractSocketDetails(conn.socket || conn)
  aedes.handle(conn, req)
}

const server = createServer(config.tlsOptions, aedes.handle)

const socket = new ws.Server({server})
socket.on('error', e => console.log(`socket error:`, e))
socket.on('connection', (conn, req) => {
  const stream = ws.createWebSocketStream(conn)
  // the _socket object is needed in bindConnection to retrieve info from the stream
  // before passing it to aedes.handle
  stream._socket = conn._socket
  bindConnection(aedes, stream, req)
})

server.listen(config.port, () => {
  console.log(`Broker ${aedes.id} listening on port ${config.port}`)
})

aedes.on('subscribe', (subscriptions, client) => {
  console.log(`MQTT client ${client ? client.id : client} subscribed to topic(s): ${subscriptions.map(s => s.topic).join('\n')} on broker ${aedes.id}`)
})

aedes.on('unsubscribe', (subscriptions, client) => {
  console.log(`MQTT client ${client ? client.id : client} unsubscribed from topic(s): ${subscriptions.join('\n')} on broker ${aedes.id}`)
})

aedes.on('client', client => {
  console.log(`Client connected: ${client ? client.id : client} to broker ${aedes.id}`)
})

aedes.on('clientDisconnect', client => {
  console.log(`Client disconnected: ${client ? client.id : client} from broker ${aedes.id}`)
})

MQTT client over WSS

const {connect} = require('mqtt')
const client = connect(`wss://127.0.0.1:4000`)
console.log('is connected :', client.connected)