Swift 5: How do you add SSL Certificate to Starscream Websocket

975 Views Asked by At

I am using the latest tag 4.0.4 of Starscream (https://github.com/daltoniam/starscream). I have created my own SSL Certificate using

openssl req -x509 -newkey rsa:4096 -nodes -keyout key.pem -out cert.pem -days 365

On my backend, I use node.js to create the https server and create a websocket with the WebSocket-Node library (https://github.com/theturtle32/WebSocket-Node)

const httpsServer = https.createServer(
{
    key: fs.readFileSync('./certs/key.pem'),
    cert: fs.readFileSync('./certs/cert.pem')
});

httpsServer.listen(1234, function() 
{
    logger.log.info(filename + "Server is listening on port " + 1234);
});

var wsServer = new webSocketServer({
    httpServer: httpsServer,
    autoAcceptConnections: false
});

In Swift 5, I can connect to and communicate with the websocket using the following code

var request = URLRequest(url: URL(string: "wss://mydomain.com:1234")!)
request.timeoutInterval = 10
let pinner = FoundationSecurity(allowSelfSigned: true)
socket = WebSocket(request: request, certPinner: pinner)
socket?.delegate = self
socket?.connect()

However, the above does not use my certificate at all. I was expecting to have to import my .cer into xcode (add to the bundle), then set up the WebSocket using the certificate. Followed by some kind of handshaking or ssl challenge before the connection is accepted.

One issue I am running into is the new Starscream library does not have "socket.security" (like older versions appear to have) or anyway to add a certificate to the connection. So I cannot figure out how to add a cert to the socket.

// I've seen other post using "socket.security", but this does not 
// appear to work anymore as "socket.security" doesn't exist
socket.security = SSLSecurity(certs: [ssl], usePublicKeys: true)

I don't know how my app is connecting and communicating without the certificate. This means anyone can communicate to my websocket if they know the domain and port #.

Shouldn't the httpsServer reject it?

Shouldn't I need to add the certificate to my app bundle and somehow configure the Websocket with it?

Primary Question: How can I secure my WebSocket so only my app (with the certificate) can communicate with my backend https websocket server?

0

There are 0 best solutions below