IMPORTANT: getUserMedia no longer work on no-secure websites (https://)

[Mamadou DIOP]

Hello,
For information, starting Chrome 47 it's no longer possible to use
getUserMedia on no-secure website (http://*). You must use a secure
website(https://*). More info at https://goo.gl/rStTGz.
We've changed all our projects (conf-call, sipml5, webrtc2sip...) to use
https://. As you probably know it's not allowed to initiate no-secure
WebSocket connections (ws://) from a secure website (https://). This
means your application will no longer work if your not using secure
websocket connection (wss://).
If you're using click2dial please regenerate your button.
In short: You *must* use a secure website for production. You still can
use http://locahost for testing.
Regards,

[Abhisek Panda]

Hi Mamadou,

                      Is it mean , now using RTCWeb Breaker module or Secure WebSocket transport (WSS) is mandatory ? Earlier we were not supporting WSS so it was no-secure website (http://*) & call was working fine but as per your notice i saw now with chrome 46 version my call is woking but not with 47 version. Can you guide what can be the options for handling this issue . Or is it a must now to use RTCWeb Breaker module or Secure WebSocket transport (WSS) & with out using thise module i won't be able to call if it is chrome 47 ?

Thanks & Regards,

Abhisek

[Mamadou DIOP]

Le 12/18/2015 7:24 AM, Abhisek Panda a écrit :

Hi Mamadou,

                      Is it mean , now using RTCWeb Breaker module or Secure WebSocket transport (WSS) is mandatory ? Earlier we were not supporting WSS so it was no-secure website (http://*) & call was working fine but as per your notice i saw now with chrome 46 version my call is woking but not with 47 version. Can you guide what can be the options for handling this issue . Or is it a must now to use RTCWeb Breaker module or Secure WebSocket transport (WSS) & with out using thise module i won't be able to call if it is chrome 47 ?

This is a must not an issue.

Thanks & Regards,

Abhisek

On Saturday, December 5, 2015 at 7:33:54 AM UTC+5:30, Mamadou wrote:

Hello,
For information, starting Chrome 47 it's no longer possible to use
getUserMedia on no-secure website (http://*). You must use a secure
website(https://*). More info at https://goo.gl/rStTGz.
We've changed all our projects (conf-call, sipml5, webrtc2sip...) to use
https://. As you probably know it's not allowed to initiate no-secure
WebSocket connections (ws://) from a secure website (https://). This
means your application will no longer work if your not using secure
websocket connection (wss://).
If you're using click2dial please regenerate your button.
In short: You *must* use a secure website for production. You still can
use http://locahost for testing.
Regards,

--
You received this message because you are subscribed to the Google Groups "discuss-doubango" group.
To unsubscribe from this group and stop receiving emails from it, send an email to doubango+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[mark mirasol]

Hello Mamadou,

We are currently doing a new setup and even our self hosted copy of sipml5 cannot connect to sip proxy.

We are getting 401 unathorized on registration to the proxy server.

Could this be the cause of the issue?  Please advise.  Thanks.

[mark mirasol]

If we try to connect to ws://209.133.200.178:10061, we can connect but we are getting the error: 

getUserMedia() no longer works on insecure origins. 

If we try to connect to wss://209.133.200.178:10062, we get the error:

WebSocket connection to 'wss://209.133.200.178:10062/' failed: WebSocket opening handshake was canceled

but webrtc2sip seems to be listening on the port please see attached screenshots.

[Mamadou DIOP]

Le 12/30/2015 6:59 AM, mark mirasol a écrit :

If we try to connect to ws://209.133.200.178:10061, we can connect but we are getting the error: 

getUserMedia() no longer works on insecure origins. 

If we try to connect to wss://209.133.200.178:10062, we get the error:

WebSocket connection to 'wss://209.133.200.178:10062/' failed: WebSocket opening handshake was canceled

You're probably using self-signed certs. Open https://209.133.200.178:10062/ in chrome and accept the warning message about the security issue then, try again in the same tab.

[mark mirasol]

Thank you.  Yes, we are.  I followed these links to generate the certificates.

http://codeghar.wordpress.com/2013/04/16/create-private-certificate-authority-on-linux/ 

http://codeghar.wordpress.com/2013/04/16/generate-certificate-signing-request-on-linux/  

http://codeghar.wordpress.com/2013/04/16/use-private-certificate-authority-to-sign-certificate-signing-request-on-linux/

I tried that but it seems that chrome thinks these certificates are malicious.  I'm getting this error.

Attackers might be trying to steal your information from 209.133.200.178 (for example, passwords, messages, or credit cards).

 

NET::ERR_CERT_INVALID

Subject: Internet Widgits Pty Ltd

Issuer: Internet Widgits Pty Ltd

Expires on: Dec 22, 2025

Current date: Dec 31, 2015

I did a google search for the certificate subject.  Other people also report that the certificates are considered malicious.

So is the solution to get an ssl certificate from somewhere and use those in the config instead?

[Abhisek Panda]

Don't you self signed certificates. It's not going to work out with self signed instead you need to buy trusted certificates. It's cost £20 I guess.

[mark mirasol]

Thank you, Mamadou and Abhisek Panda.

I'm using Google Chrome Version 47.0.2526.106 m.  

I do not know where to accept the warning message.  

If I go to https://209.133.200.178:10062/, there's no button to proceed unsafely.

The message was similar to this.

http://i.imgur.com/E58gyIL.png

Abhisek, what troubles did you encounter with self-signed certificates?  Please share.

What I learned is that the default setting for common name needs to match your url.

ref: https://serversforhackers.com/self-signed-ssl-certificates

Before I left all the settings as default, following the links below.

http://codeghar.wordpress.com/2013/04/16/create-private-certificate-authority-on-linux/ 

http://codeghar.wordpress.com/2013/04/16/generate-certificate-signing-request-on-linux/  

http://codeghar.wordpress.com/2013/04/16/use-private-certificate-authority-to-sign-certificate-signing-request-on-linux/

So I redid the steps and was able to get it working by exporting the root certificate authority and importing it to windows.

After that, it worked.

[ron....@entropysolution.com]

Hi Mark,

Would you mind sharing your ssl-certificate configuration under the config.xml file? We are also having issues with self signed certificates.

BR,

Ron

[mark mirasol]

Hi Ron,

The only thing I did different was use our public ip when it asks for common name.

Common name needs to either match your domain, fqdn or ip address.

Everything else is the same.

Regards,

Mark

--
You received this message because you are subscribed to a topic in the Google Groups "discuss-doubango" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/doubango/-6XKVB_Y1kY/unsubscribe.
To unsubscribe from this group and all its topics, send an email to doubango+u...@googlegroups.com.

[ron....@entropysolution.com]

Hi Mark,

Thank you for the info.

Our ssl-certificates config in config.xml shows like this:

<ssl-certificates>

     /home/cg/myca/private/key.ca.cg.pem

     /home/cg/myca/certs/crt.ca.cg.pem

     *;

     no

</ssl-certificates>

Is this complete or did we missed something? No errors received upon restarting the webrtc2sip server. We only have issue in the registration part.

BR,

Ron

[mark mirasol]

Ron, please share your chrome javascript console / webrtc2sip log so everyone can help you.  

I am not an expert in vici or webrtc2sip.  Credit goes to navaismo and mamadou for the great support.  

I will share what I have learned in hopes that it can help but navaismo and mamadou are the experts, not me.

[mark mirasol]

I noticed your config file is missing semicolons at the end of the lines.

Here is the guide I followed to setup our instance.

https://github.com/noahseis/webrtc2sip/blob/master/readme_install_walkthrough.txt

[ron....@entropysolution.com]

Thanks for the info mark. 

Mamadou already told us about the issue regarding the self-signed certificates on this thread "https://groups.google.com/forum/#!topic/doubango/7eVRYMW7IZY". 

I'm checking other workarounds regarding the self-signed certificates. since you were able to make it work, i was hoping you can share what you have.

regarding the missing semicolon, we actually have those at the end of each certificate address. i think i just forgot to type it here. :)

<ssl-certificates>

     /home/cg/myca/private/key.ca.cg.pem;

     /home/cg/myca/certs/crt.ca.cg.pem;

     *;

     no

</ssl-certificates>

BR,

Ron

[mark mirasol]

Oh ok. The only other thing I did was import the ca root certificate into my browser. This made the browser identify the certificate directly.

[mark mirasol]

The certificate I imported is the one generated from this link.
http://codeghar.wordpress.com/2013/04/16/create-private-certificate-authority-on-linux/

[ron....@entropysolution.com]

Thanks mark for the help. :)

Much appreciated. I restarted chrome after putting the ca root certificate to my browser. now it returned FORBIDDEN error. I think we are now on the right track. ;)

Thank again.

BR,

Ron

[Abhisek Panda]

Guys, i've tried the below & my signalling is happening also audio is going.

You can create the ssl certificate by using comodo

https://ssl.comodo.com/free-ssl-certificate.php

It is easy to create & creating properly as well. Very less time it's getting created . Those crt & bundle files you can apply to be used by apache & config.xml of webrtc2sip.

In case can follow the below link as well but go for thre comodo solution.

https://groups.google.com/forum/?fromgroups#!topic/discuss-webrtc/M9u6hxOfOeY

[mark mirasol]

If you're getting that, click the padlock on the url box and see if your certificate can identify the site. At first mine said the url didnt match, that's what told me that something was wrong with my certificate.

But if it's red and it says the certificate has identified the site but the there's a problem with public verification (forgot the exact term) or something then you should be good to go.

[mark mirasol]

Thanks for sharing, Abhisek.

[mark mirasol]

Correction the term was certificate transparency. This is the last error shown on the padlock which we chose to ignore because our server is not sending any information to any public db for identification.

[Gilbert Arias]

hello i have added ssl cert to my website but still not working: https://www.infrasistemas.com.uy/ 

what should i do to fix the clicktocall button ?