How to use HTTPS (SSL) with Zinc
Okay, so I have my nice little Teapot app, but I'd like to run it as HTTPS. As far as I can understand, to do this I must go through Zinc. However, the docs on the web seem rather out of date. For example, I do not have ZnZincServerAdapter (in Pharo 5.0). In the simplest terms, how do I support HTTPS? (I've created my self-signed cert.) Thanks. -- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
Hi,
On 23 Jun 2017, at 20:41, horrido <horrido.hobbies@gmail.com> wrote:
Okay, so I have my nice little Teapot app, but I'd like to run it as HTTPS. As far as I can understand, to do this I must go through Zinc. However, the docs on the web seem rather out of date. For example, I do not have ZnZincServerAdapter (in Pharo 5.0).
ZnZincServerAdapter is specific for Seaside.
In the simplest terms, how do I support HTTPS? (I've created my self-signed cert.)
(ZnSecureServer on: 1443) certificate: '/home/sven/ssl/key-cert.pem'; logToTranscript; start; yourself. I don't know how Teapot is implemented, but it uses Zinc, so somehow it will work. You should figure where/how it creates/starts its ZnServer. Note that this might not run on every platform (it depends on the SSL plugin, I know Linux used to work). Sven
Thanks.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
I get an "SSL Exception: accept failed [code:-5]" error. Is it because I have a self-signed cert? Apparently, it's failing on: result := self sslSession accept: in from: 1 to: count into: out. Sven Van Caekenberghe-2 wrote
Hi,
On 23 Jun 2017, at 20:41, horrido <
horrido.hobbies@
> wrote:
Okay, so I have my nice little Teapot app, but I'd like to run it as HTTPS. As far as I can understand, to do this I must go through Zinc. However, the docs on the web seem rather out of date. For example, I do not have ZnZincServerAdapter (in Pharo 5.0).
ZnZincServerAdapter is specific for Seaside.
In the simplest terms, how do I support HTTPS? (I've created my self-signed cert.)
(ZnSecureServer on: 1443) certificate: '/home/sven/ssl/key-cert.pem'; logToTranscript; start; yourself.
I don't know how Teapot is implemented, but it uses Zinc, so somehow it will work. You should figure where/how it creates/starts its ZnServer.
Note that this might not run on every platform (it depends on the SSL plugin, I know Linux used to work).
Sven
Thanks.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952476.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
On 23 Jun 2017, at 23:39, horrido <horrido.hobbies@gmail.com> wrote:
I get an "SSL Exception: accept failed [code:-5]" error. Is it because I have a self-signed cert?
Apparently, it's failing on:
result := self sslSession accept: in from: 1 to: count into: out.
Platform ? Pharo version ? It also depends on how you made the certificate. Note that not all browsers like self-signed certificates. It should work on Linux. This is how I once did it (making the certificate), in 2013-2014 (I know that others have managed to do this too): ==== sven@netbook:~/ssl$ openssl genrsa -out privkey.pem 1024 Generating RSA private key, 1024 bit long modulus ..........................................................++++++ .++++++ e is 65537 (0x10001) sven@netbook:~/ssl$ openssl req -new -key privkey.pem -out certreq.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:BE State or Province Name (full name) [Some-State]: Locality Name (eg, city) []:Hasselt Organization Name (eg, company) [Internet Widgits Pty Ltd]:STfx.eu Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:Sven Van Caekenberghe Email Address []:sven@stfx.eu Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: sven@netbook:~/ssl$ ls certreq.csr privkey.pem sven@netbook:~/ssl$ openssl x509 -req -days 3650 -in certreq.csr -signkey privkey.pem -out newcert.pem Signature ok subject=/C=BE/ST=Some-State/L=Hasselt/O=STfx.eu/CN=Sven Van Caekenberghe/emailAddress=sven@stfx.eu Getting Private key sven@netbook:~/ssl$ ( openssl x509 -in newcert.pem; cat privkey.pem ) > server.pem (ZnSecureServer on: 1443) certificate: '/home/sven/ssl/server.pem'; logToTranscript; start; yourself. ====
Sven Van Caekenberghe-2 wrote
Hi,
On 23 Jun 2017, at 20:41, horrido <
horrido.hobbies@
> wrote:
Okay, so I have my nice little Teapot app, but I'd like to run it as HTTPS. As far as I can understand, to do this I must go through Zinc. However, the docs on the web seem rather out of date. For example, I do not have ZnZincServerAdapter (in Pharo 5.0).
ZnZincServerAdapter is specific for Seaside.
In the simplest terms, how do I support HTTPS? (I've created my self-signed cert.)
(ZnSecureServer on: 1443) certificate: '/home/sven/ssl/key-cert.pem'; logToTranscript; start; yourself.
I don't know how Teapot is implemented, but it uses Zinc, so somehow it will work. You should figure where/how it creates/starts its ZnServer.
Note that this might not run on every platform (it depends on the SSL plugin, I know Linux used to work).
Sven
Thanks.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952476.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
This is on my Raspberry Pi running the latest Raspbian. I'm using Pharo 5.0. The browser is Firefox. Sven Van Caekenberghe-2 wrote
On 23 Jun 2017, at 23:39, horrido <
horrido.hobbies@
> wrote:
I get an "SSL Exception: accept failed [code:-5]" error. Is it because I have a self-signed cert?
Apparently, it's failing on:
result := self sslSession accept: in from: 1 to: count into: out.
Platform ? Pharo version ?
It also depends on how you made the certificate. Note that not all browsers like self-signed certificates.
It should work on Linux. This is how I once did it (making the certificate), in 2013-2014 (I know that others have managed to do this too):
====
sven@netbook:~/ssl$ openssl genrsa -out privkey.pem 1024 Generating RSA private key, 1024 bit long modulus ..........................................................++++++ .++++++ e is 65537 (0x10001) sven@netbook:~/ssl$ openssl req -new -key privkey.pem -out certreq.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:BE State or Province Name (full name) [Some-State]: Locality Name (eg, city) []:Hasselt Organization Name (eg, company) [Internet Widgits Pty Ltd]:STfx.eu Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:Sven Van Caekenberghe Email Address []:
sven@
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: sven@netbook:~/ssl$ ls certreq.csr privkey.pem sven@netbook:~/ssl$ openssl x509 -req -days 3650 -in certreq.csr -signkey privkey.pem -out newcert.pem Signature ok subject=/C=BE/ST=Some-State/L=Hasselt/O=STfx.eu/CN=Sven Van Caekenberghe/emailAddress=
sven@
Getting Private key sven@netbook:~/ssl$ ( openssl x509 -in newcert.pem; cat privkey.pem ) > server.pem
(ZnSecureServer on: 1443) certificate: '/home/sven/ssl/server.pem'; logToTranscript; start; yourself.
====
Sven Van Caekenberghe-2 wrote
Hi,
On 23 Jun 2017, at 20:41, horrido <
horrido.hobbies@
> wrote:
Okay, so I have my nice little Teapot app, but I'd like to run it as HTTPS. As far as I can understand, to do this I must go through Zinc. However, the docs on the web seem rather out of date. For example, I do not have ZnZincServerAdapter (in Pharo 5.0).
ZnZincServerAdapter is specific for Seaside.
In the simplest terms, how do I support HTTPS? (I've created my self-signed cert.)
(ZnSecureServer on: 1443) certificate: '/home/sven/ssl/key-cert.pem'; logToTranscript; start; yourself.
I don't know how Teapot is implemented, but it uses Zinc, so somehow it will work. You should figure where/how it creates/starts its ZnServer.
Note that this might not run on every platform (it depends on the SSL plugin, I know Linux used to work).
Sven
Thanks.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952476.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952478.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
I discovered that I skipped an important step in creating the SSL cert. HTTPS is now working. However, for some reason, it's not finding my Teapot routes. The route that worked in http://localhost:1701/login, for example, no longer works in https://localhost:1443/login. I'm investigating... -- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952492.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
Okay, I think I understand. There are two server instances, one for http and one for https. How do I get Teapot to use the one for https??? horrido wrote
I discovered that I skipped an important step in creating the SSL cert. HTTPS is now working. However, for some reason, it's not finding my Teapot routes. The route that worked in http://localhost:1701/login, for example, no longer works in https://localhost:1443/login. I'm investigating...
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952493.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
Teapot uses ZnServer defaultServerClass by default, but you can configure Teapot to use other kind of ZnServers like this. This is available only in the latest development version. -- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952501.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
On 24 Jun 2017, at 09:26, Attila Magyar <m.magyar3@gmail.com> wrote:
Teapot uses ZnServer defaultServerClass by default, but you can configure Teapot to use other kind of ZnServers like this.
This is available only in the latest development version.
That's very nice. Thanks for the reply, Attila. (In regular mail, I don't see you code snippet, I copy it here). secureServer := (ZnSecureServer on: 1443) certificate: '/path/to/keypair'; logToTranscript; yourself. teapot := Teapot configure: { #znServer -> secureServer }. teapot GET: '/test' -> 'secure'; start.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952501.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
Sven Van Caekenberghe-2 wrote
(In regular mail, I don't see you code snippet, I copy it here).
Hmm, maybe because of the raw text tags. Is this visible? Transcript show: 'Hello world'; cr. -- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952503.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
On 24 Jun 2017, at 10:03, Attila Magyar <m.magyar3@gmail.com> wrote:
Sven Van Caekenberghe-2 wrote
(In regular mail, I don't see you code snippet, I copy it here).
Hmm, maybe because of the raw text tags. Is this visible?
Transcript show: 'Hello world'; cr.
Yes, that we can see in the regular ML.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952503.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
Are you referring to ConfigurationOfTeapot? I presume it's not loaded by your instruction: Gofer it smalltalkhubUser: 'zeroflag' project: 'Teapot'; configuration; loadStable. So how do I load it? Attila Magyar wrote
Teapot uses ZnServer defaultServerClass by default, but you can configure Teapot to use other kind of ZnServers like this.
This is available only in the latest development version.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952505.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
Okay, I should've asked, how do I get the development version? horrido wrote
Are you referring to ConfigurationOfTeapot? I presume it's not loaded by your instruction:
Gofer it smalltalkhubUser: 'zeroflag' project: 'Teapot'; configuration; loadStable.
So how do I load it?
Attila Magyar wrote
Teapot uses ZnServer defaultServerClass by default, but you can configure Teapot to use other kind of ZnServers like this.
This is available only in the latest development version.
-- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952506.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
Gofer it smalltalkhubUser: 'zeroflag' project: 'Teapot'; configuration; loadDevelopment. -- View this message in context: http://forum.world.st/How-to-use-HTTPS-SSL-with-Zinc-tp4952461p4952507.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
participants (3)
-
Attila Magyar -
horrido -
Sven Van Caekenberghe