Coldfusion 11 - Web Sockets via SSL

Question

Help!
I can't seem to figure out how to handle WSS (Websockets over SSL). I have a cert that has already been sent/received by verifier. I have a cert and an intermediate cert. I've been looking at documentation and from what I've gathered i need to add the certs to the "keystore". I issued a command like this ->>>  D:\CF11\jre\bin\keytool -import -v -alias myCert-cert -file myCert.cer -keystore D:\CF11\jre\lib\security\cacerts -storepass changeit <-- I see the cert is added. And if list the keystore i see the number of certs increased by one. I then enable the SSL WS, use default port (built in server.. not proxied), and point it to the keystore D:\CF11\jre\lib\security\cacerts and for pass i simply use the default changeit.... I've modified my cfcode to have the secure="true" attribute. So I think everything is setup correctly ....but...  when i goto the webpage the web socket will try to connect then simply not connect (Firebug says the connection was refused) (The code works fine removing the secure attribute and accessing via http) ... So i guess i'm not sure exactly what i should be doing. Can i use the same cert that I had created via IIS. The cert looks valid. Also further more i see nothing showing up in the log files.. I see a log called WebSocket.log but the size is 0 and nothing is being thrown in the exception log either.. I'm completely confused.

Answer 1

Hi Sharma,
I also sent you a note directly via email (see below). I am having a similar issue to Prem without resolution.
Our CF11 server configuration:
Windows 2012 Server R2
IIS 8
We have a *.balboadigital.com registered RapidSSL certificate installed on our server which resolves to https://dev.balboadigital.com on this particular development box. I've been unable to locate any online resources which would show me how to utilize this certificate for websockets within CF11. Due to this, I was happy to find your reference to try a self-signed certificate. I followed your instructions. Here is the breakdown:
1. I generated the keystore per your instructions which created the websocket.crt file.
2. The CF server XML was uncommented and updated to:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
                keystoreFile="C:\ColdFusion11\jre\bin\websocket.crt" keystorePass="[my password]"/>
3. I restarted the  CF11 Application Windows service.
4. The "Use Built-In WebSocket Server" radio button was selected with PORT: 8575 for non-SLL and PORT: 8543 for SSL as defaults. The KeyStore was set to "C:/ColdFusion11/jre/bin/websocket.crt" and the KeyStore Password to "[MyPassword]" and changes posted.
5. I restarted the  CF11 Application Windows service.
6. I then ran a test web page: https://dev.balboadigital.com/admin/websocket/index_withssl.cfm (this is live for you to test)
Application.cfc
<CFCOMPONENT>
    <CFSCRIPT>
    this.name = "balboa";
    this.wschannels = [{name="phone"}];
    </CFSCRIPT>
</CFCOMPONENT> 
index_withSSL.cfm
<script type="text/javascript">
    function mymessagehandler(atoken)
        if (atoken.data != null) {
            var message = ColdFusion.JSON.encode(atoken.data);
            var txt = document.getElementById("myDiv");
            txt.innerHTML += message + "<br>";
    function publishmessage()
        var msg = document.getElementById("message").value;
        mycfwebsocketobject.publish("phone.4",msg );
</script>
<cfwebsocket name="mycfwebsocketobject"  onmessage="mymessagehandler" subscribeto="phone" secure="true">
"Phone" Message: <input id ="message" type="text" > <input type="button" onclick="publishmessage();" value="Publish Message"><br />
<cfdiv id="myDiv"></cfdiv> 
The test fails and returns the following from the Google Chrome Console:
WebSocket connection to 'wss://dev.balboadigital.com:8543/cfusion/cfusion' failed: WebSocket opening handshake was canceled
7. The script was copied and modified to eliminate SSL as follows: http://dev.balboadigital.com/admin/websocket/index_nossl.cfm (this is live for you to test)
index_nossl.cfm
<script type="text/javascript">
    function mymessagehandler(atoken)
        if (atoken.data != null) {
            var message = ColdFusion.JSON.encode(atoken.data);
            var txt = document.getElementById("myDiv");
            txt.innerHTML += message + "<br>";
    function publishmessage()
        var msg = document.getElementById("message").value;
        mycfwebsocketobject.publish("phone",msg );
</script>
<cfwebsocket name="mycfwebsocketobject"  onmessage="mymessagehandler" subscribeto="phone">
"Phone" Message: <input id ="message" type="text" > <input type="button" onclick="publishmessage();" value="Publish Message"><br />
<cfdiv id="myDiv"></cfdiv> 
This test passes and works as expected, but no SSL.
Please advise as our application absolutely requires that SSL is working for us.
Thanks,
Kevin