Are secure websockets possible?

[tresf]

So I'm growing increasingly concerned with the feasibility of secure websockets

The current obstacles:

• [x] Generating a self-signed CA certificate that works with Firefox
  • From research, Endpoint Entitiy cert can't be a CA cert
  • Jetty must start using the Endpoint Entity cert
  • Firefox must import the CA cert
  • How can we script this for all platforms at install time?
• [x] Import the CA certificate into Firefox
  • Is there an existing C++ API we can talk to? (I think so, per https://github.com/qzind/qz-print/issues/18#issuecomment-97535247)
  • If we leverage the NSS tools, how do we compile and distribute them with the installers?
  • Firefox certs are stored in the user profile.
  • What if Firefox is installed AFTER QZ Tray?
  • Can we import the certificate every time the software is started?
• [x] Fallback method for when secure websockets fails
  • Can Jetty listen on an alternate port for non-secure connections?
  • Moving this to #15

[tresf]

Generating a self-signed CA certificate that works with Firefox

This was fixed by turning off the CA flag in the certificate so that Jetty acts as an Endpoint Entity. The reason this works is when the GUI isn't being used to import the cert, non-CA certs can be added to the Firefox Trusted CA Root Store.

Import the CA certificate into Firefox

This is tackled via two new files: ant/firefox/firefox-config.cfg.in and ant/firefox/firefox-prefs.js.in which are copied into the Program Files\Mozilla Firefox\ directory and used as a deployment rule which is run each time Firefox is launched.