Join Log in
Score:0
avatar Server

Sharing a Let's Encrypt certificate with a node websocket connection on the same domain? Possible? Advisable?

us flag
Jon

Is it possible / advisable to register and renew a Let's Encrypt certificate through Nginx for https, and share that same certificate on a websocket connection (wss://) on the same domain? The websocket server is being ran off of node.js (Colyseus to be specific - which has Express built in)

If not, is it worth setting Nginx as a reverse proxy in front of the websocket server and setting the certificates that way?

And finally, if it is a good idea to just use one certificate and share it with the websocket server, what's the best way to get Express to reload the files when certbot renews the certificate? Can certbot inform the server it updated the certificates? Or do the files need to be reloaded at all

120
0 + 0
Score:2
drookie avatar Server
za flag
drookie

Is it possible / advisable to register and renew a Let's Encrypt certificate through Nginx for https, and share that same certificate on a websocket connection (wss://) on the same domain? The websocket server is being ran off of node.js (Colyseus to be specific - which has Express built in)

Possible but not advisable: the advisable approach is to use industry-standard web-server in front as the reverse proxy, and the number one among those is nginx at the time of this answer. However, haproxy can also act as one.

If not, is it worth setting Nginx as a reverse proxy in front of the websocket server and setting the certificates that way?

Yeah, that's a recommended approach. Because, once again, you don't usually run peculiar applications bound to the HTTP/HTTPS port directly: this forbids you from various types of important functionality. Seamless reload on the certificate renewal is one of them.

And finally, if it is a good idea to just use one certificate and share it with the websocket server, what's the best way to get Express to reload the files when certbot renews the certificate?

Basically you just run certbot renew (crond runs it for ya) and just tell the nginx to refresh it with nginx -s reload.

Can certbot inform the server it updated the certificates?

I'm unaware about this, but this mechanism is not really needed anyway - with LE certificates this should happen only once in 3 months, so ...

Or do the files need to be reloaded at all

Sure they do. How can they not be - they are loaded only once on the start of web-server.

0 + 0
us flag
Jon
Thank you for the answer. I have one more question though - is using nginx as a reverse proxy going to add a delay or increased packet size to / from my websocket server? The ws server is for a game where even 50ms more latency would be bad. Also for the record I was running, and was planning on continuing to run the ws server on port 2537 (iirc, definitely not port 80)
0
Reply
drookie avatar
za flag
drookie
It will add some additional delay for sure, but we are talking about the delay around millisecond or it's fraction. To add 50 ms millisecond delay your reverse proxy will have to reside in another datacenter several thousands kilometers away from your node.js instance.
1
Reply
drookie avatar
za flag
drookie
And nothing will happen to the packet size. It will effectively be of the same size. :)
1
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.