SSL via Linux [Docker] possible ?

[JMF386]

Hello !

First of all, I would like to say that your program saved me several days of work, about ten hours of training and several weeks of hardship.

However, I am stuck on a tricky point: the use of SSL.

Indeed, the use of it is well documented for the installation.

However, I have two questions on this subject:

• 1 - Does it allow the use of SSLv3?

• 2 - [If the answer is "yes" to the one above] What is the procedure to perform in the case of a system under Linux or more precisely, on a Docker container?

The more exact reason for the question:

I am designing a second web server involving the use of SSLv3 particularly.

The problem being that when I looked through all the documentation, I didn't see any specific/equivalent information on this exact topic for this software.

As a result, I don't see how to completely adapt the Windows procedure to a Linux procedure.

I thank you for the good consideration of my message and I wish you an excellent day/evening ;)

Sincerely,

• Johnny

[jchristn]

Hi Johnny, thanks for your kind words and your note.

Watson uses the underlying certificate store, so assuming the underlying operating system's certificate store supports it, it should work fine for Watson.

I tested with an earlier version on Ubuntu some time ago but neglected to document the steps. I will try to do so in the next week or so.

If in the meantime you are able to do it, I'd love the steps to reproduce so I can produce an article similar to the one I provided for Windows.

Cheers, Joel

[jchristn]

I believe this was the article I used. Again not for SSLv3 though. I really wish I would have saved the link: http://joshua.perina.com/geo/post/using-ssl-https-with-mono-httplistener

[jchristn]

I'm producing an alternate set of instructions specifically on SSLv3. Just finished the Windows piece, now trying to get this going on Ubuntu. Will report back.

[JMF386]

Good evening !

Thank you for all these feedbacks which are very pleasant and useful ;)

I take note of all the information put above and also take note of the progress with Ubuntu.

Know that what you are doing thanks to my request helps me a lot and I thank you warmly ;)

Of course, I remain at your disposal if you need specific and/or additional information.

I wish you an excellent evening.

Sincerely yours,

• Johnny

[jchristn]

Used this to install OpenSSL on Ubuntu 20.04: https://idroot.us/install-openssl-ubuntu-20-04/

[jchristn]

Testing using this code: https://github.com/jchristn/WatsonWebserverTest

[jchristn]

Well, there's a problem. A second order problem was that I knew about it, but forgot.

Please refer to: dotnet/runtime#19752

As of right now, there doesn't appear to be a way to do this using .NET Core or .NET 5/6. There is a solution for Mono with .NET Framework, but I wouldn't suggest using Mono.

The solution with Mono uses the httpcfg command, but in order to get that command, you have to 1) install Mono and 2) use Mono with the .NET Framework. More info on the Mono implementation is here: https://stackoverflow.com/questions/23243224/how-to-use-ssl-with-httplistener-with-an-mkbundled-mono-app

Net-net: we're at Microsoft's mercy on this one. I'd suggest using nginx as a front-end with SSL, and leave your app as non-SSL.

If you'd like, I can cook up an example with steps for you. Let me know.

[JMF386]

Good evening !

Thank you for your reactivity on this subject of this whole set.

Indeed, I have just looked that it is not possible directly under .NET (Except .NET Framework but involving Mono).

The proposed suggestion being a backup solution that can be considered anyway, I am very interested to have an example as you have proposed what I thank you for that.

It will still be able to help me, so if there is a way forward, I'll take the opportunity 😁

Again, a big thank you to you.

Sincerely yours,

• Johnny

[jchristn]

Sample nginx configuration (taken partially from here

events {
  worker_connections  1024;  ## Default: 1024
}

http {
    log_format main '$remote_addr [$time_local] req:$request host:$http_host '
                    'status:$status sent:$body_bytes_sent '
                    ;
    access_log ./access.log main;

    upstream myserver {
        server localhost:8000;
    }

    server {
        listen 443 ssl;
	server_name localhost:443;
        ssl_certificate     www.example.com.crt;
        ssl_certificate_key www.example.com.key;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         HIGH:!aNULL:!MD5;
        location / {
            proxy_pass http://myserver;
            proxy_set_header Host localhost;
        }
        access_log ./myserver.log main;
    }
}