Currently only the Websocket side supports TLS (through the -tlscert and -tlskey options). Support should be added for TLS on the TCP side.
This could be done by adding a flag (e.g. -tcptls or -tls) which causes ws-tcp-relay to use crypto/tls to dial the connection instead of net. Additional options may need to be added for configuring the connection (see https://golang.org/pkg/crypto/tls/#Config), such as specifying the root CAs.
Care should be taken to avoid confusion between client-side (TCP) and server-side (WSS) TLS. This may mean renaming the -tlscert and -tlskey options, although the old ones should be retained for backwards-compat.
Proposed new usage:
Usage: ws-tcp-relay <tcpTargetAddress>
-b Use binary frames instead of text frames
-binary
Use binary frames instead of text frames
-p uint
The port to listen on (default 4223)
-port uint
The port to listen on (default 4223)
-wsscert string (also -tlscert)
Path to a certificate (PEM file) to use for serving WebSockets using TLS. If the certificate is signed by
a certificate authority, the file should be the concatenation of the server's certificate, any
intermediates, and the CA's certificate. Must also specify -wsskey.
-wsskey string (also -tlskey)
Path to a private key (PEM file) to use for serving WebSockets using TLS. Must also specify -wsscert.
-tcptls
Use TLS for outgoing TCP connections
-tcptlscert
Path (or multiple paths) to a certificate (PEM file) to use for outgoing TCP connections using TLS.
May be specified multiple times Only used when -tcptls is specified.
-tcptlsrootcert
TODO
Did you get it done? Need help creating a wss support through websocket-nats (Using in my angular app). relay working properly without tls. but with tls giving handshake errors. (verified my certs as well)
Currently only the Websocket side supports TLS (through the
-tlscert
and-tlskey
options). Support should be added for TLS on the TCP side.This could be done by adding a flag (e.g.
-tcptls
or-tls
) which causesws-tcp-relay
to usecrypto/tls
to dial the connection instead ofnet
. Additional options may need to be added for configuring the connection (see https://golang.org/pkg/crypto/tls/#Config), such as specifying the root CAs.Care should be taken to avoid confusion between client-side (TCP) and server-side (WSS) TLS. This may mean renaming the
-tlscert
and-tlskey
options, although the old ones should be retained for backwards-compat.Proposed new usage: