Chatnaut/Arclight

when enabling SSL noVNC stops working

marcel-st opened this issue · 2 comments

marcel-st commented

i've enabled SSL in apache by using a letsencrypt certificate, however when actived opening a console seems impossible.

powered_on

All attempts end in $HOST refused to connect.

clicked link

When i access the Webgui on HTTP, everything works fine.

Here is my VirtualHost configuration:

<VirtualHost *:80>
       ServerName server.mydomain
        ErrorLog logs/error_log
        TransferLog logs/access_log
        LogLevel warn

        <Directory "/var/www/html/arclight">
                Options +FollowSymlinks
                AllowOverride All
                Order Allow,Deny
                Allow from all
        </Directory>
	DocumentRoot "/var/www/html/arclight"
</VirtualHost>

<VirtualHost *:443>
        ServerName server.mydomain
        ErrorLog logs/ssl_error_log
        TransferLog logs/ssl_access_log
        LogLevel warn

        <Directory "/var/www/html/arclight">
                Options +FollowSymlinks
                AllowOverride All
                Order Allow,Deny
                Allow from all
        </Directory>
        DocumentRoot "/var/www/html/arclight"

        SSLEngine on
        SSLProtocol all -SSLv2 -SSLv3
        SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA
        SSLCertificateFile /opt/ssl/live/domain/cert.pem
        SSLCertificateKeyFile /opt/ssl/live/domain/privkey.pem
        SSLCertificateChainFile /opt/ssl/live/domain/chain.pem
        SSLCACertificateFile /opt/ssl/live/domain/fullchain.pem

        <Files ~ "\.(cgi|shtml|phtml|php?)$">
            SSLOptions +StdEnvVars
        </Files>

        BrowserMatch "MSIE [2-5]" \
                 nokeepalive ssl-unclean-shutdown \
                 downgrade-1.0 force-response-1.0
</VirtualHost>
S4nfs commented

Hi @marcel-st thanks for raising this issue and yes it works absolutely fine on HTTP. I am already aware of it and currently working on fixing the issue in the next patch. Just update the package as soon as it's available.

marcel-st commented

I found the solution, you need to create the self.pem certificate in /etc/ssl.

For letsencrypt certificates use the following command:

cat /etc/letsencrypt/live//cert.pem /etc/letsencrypt/live//chain.pem /etc/letsencrypt/live//privkey.pem > /etc/ssl/self.pem

then restart the server and it works like a charm.

don't forget to redo the above command when the certificate is renewed!

  • 👍1