Secure WebSocket (WSS) with HTTPS localhost SSL certificate?

1
votes

I am a little new to this whole WebSocket and SSL certificate.

So I have created my own WebSocket server on Android side and the website is the client. I was able to make it work with regular WebSocket (ws://) but not secure WebSocket (wss://) due to the fact that it requires SSL certificate.

My question is how can I get a SSL certificate? From what I've read, SSL certificate is based on a domain. I need it for localhost. I need it for something like this address:

wss://localhost:8080/ws/main

How can I go about getting a SSL certificate that will work with localhost.

Thank you for your time!

====================== EDIT =====================

Reason why I am doing this: I have a Bluetooth service in my Android application that will be getting data from connected health bluetooth devices like Weight Scale and Blood Pressure machine. I have this part implemented already and I want to take this data and pass it to a website. WebSocket seemed easier because the user will have my application open and when they do their weight, it would automatically fill the field on the website with the weight from the Weight Scale. I hope I am making this clear.

To do this, I need to have a way to pass the weight or blood pressure values from Java (Android) to the website that loads within a WebView. So I thought WebSocket would the easiest way.

Please tell me if you think there is an easier way.

Also, I've already tried self-signed certificate and I get the following error:

I/X509Util: Failed to validate the certificate chain, error: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

OR

Exception=javax.net.ssl.SSLException: Error occured in delegated task:javax.net.ssl.SSLException: Not trusted server certificate

Thank you!!!

1
androidsslhttpswebsocket
Having an open port on an Android device is a risky proposition from a security standpoint. Beyond that, please explain how a localhost Web socket is being used by a "website". Is this Web server also hosted on the Android device? If it is a Web server hosted elsewhere, I do not see how it can use a Web socket that is only available via localhost. With respect to SSL and localhost, that's not possible AFAIK. - CommonsWare
The websocket server is within the Android application and I am loading the the websocket client (the website) in a webview within the same application. That is why it is localhost. This implementation works with regular websockets and I am able to send the data. I know the logic isn't the issue. Thanks for your reply. - ᴛʜᴇᴘᴀᴛᴇʟ
I am unclear why you are using WebSockets in the first place, given that there are more efficient and secure options for having the on-device Web app communicate back to your Java code. SSL would seem to be pointless, given that the packets are not leaving your device. Regardless, other than perhaps a self-signed SSL cert, I don't know of any way to SSL encrypt localhost. - CommonsWare
@CommonsWare please see my edit on the post. I've explained why I do this. Thanks again!! - ᴛʜᴇᴘᴀᴛᴇʟ
"Please tell me if you think there is an easier way" -- addJavascriptInterface() on WebView. - CommonsWare

1 Answers

0
votes

We faced a similar problem, our solution was to register a subdomain to one of our domains with an A record to 127.0.0.1 and get a certificate for that domain.

  • local.example.com -> A record to 127.0.0.1
  • SSL certificate requested for local.example.com

I'm afraid this answer is too late for you however, it can be helpful for others finding this article.