Websockets over SSL

Question

我正在使用Ratchet在PHP中实现基于Websockets的应用程序，如果我处于http模式（ws），我就可以成功地实现这一点

如果我切换到https，我将无法执行同样的操作。它显示连接超时，我甚至尝试了telnet，但我在服务器终端端没有看到任何响应（显示客户端已连接）

1） 我使用的是ws而不是ws

var conn = new WebSocket('wss://www.mysite.com:8080/wss2');

我在哪里根据这个答案设置了wss2：php棘轮websocket SSL连接？（我已经将Proxypass行添加到我的apache配置文件中）

2） 我加载了所有必要的apache模块

[0] => core
[1] => mod_so
[2] => mod_watchdog
[3] => http_core
[4] => mod_log_config
[5] => mod_logio
[6] => mod_version
[7] => mod_unixd
[8] => mod_access_compat
[9] => mod_alias
[10] => mod_auth_basic
[11] => mod_authn_core
[12] => mod_authn_file
[13] => mod_authz_core
[14] => mod_authz_host
[15] => mod_authz_user
[16] => mod_autoindex
[17] => mod_deflate
[18] => mod_dir
[19] => mod_env
[20] => mod_filter
[21] => mod_headers
[22] => mod_mime
[23] => prefork
[24] => mod_negotiation
[25] => mod_php5
[26] => mod_proxy
[27] => mod_proxy_ajp
[28] => mod_proxy_balancer
[29] => mod_proxy_connect
[30] => mod_proxy_html
[31] => mod_proxy_http
[32] => mod_proxy_wstunnel
[33] => mod_rewrite
[34] => mod_setenvif
[35] => mod_slotmem_shm
[36] => mod_socache_shmcb
[37] => mod_ssl
[38] => mod_status

3） 我确实重新启动了apache服务器

4） 如果我将此添加到配置中，我的服务器将无法工作：

Listen 443
NameVirtualHost *:443
<VirtualHost *:443>
SSLEngine On
# Set the path to SSL certificate
# Usage: SSLCertificateFile /path/to/cert.pem
SSLCertificateFile /etc/apache2/ssl/file.pem

# Servers to proxy the connection, or;
# List of application servers:
# Usage:
# ProxyPass / http://[IP Addr.]:[port]/
# ProxyPassReverse / http://[IP Addr.]:[port]/
# Example: 
ProxyPass / http://0.0.0.0:8080/
ProxyPassReverse / http://0.0.0.0:8080/
# Or, balance the load:
# ProxyPass / balancer://balancer_cluster_name

如果我添加以下内容，我在日志中会出现错误：

[Sat Dec 26 02:14:11.534788 2015] [core:info] [pid 5728] AH00096: removed PID file /var/run/apache2/apache2.pid (pid=5728)
[Sat Dec 26 02:14:11.534857 2015] [mpm_prefork:notice] [pid 5728] AH00169: caught SIGTERM, shutting down
[Sat Dec 26 02:14:12.630024 2015] [ssl:info] [pid 6194] AH01887: Init: Initializing (virtual) servers for SSL
[Sat Dec 26 02:14:12.630047 2015] [ssl:info] [pid 6194] AH01914: Configuring server 127.0.1.1:443 for SSL protocol
[Sat Dec 26 02:14:12.630352 2015] [ssl:warn] [pid 6194] AH01909: 127.0.1.1:443:0 server certificate does NOT include an ID which matches the server name

来源：https://www.digitalocean.com/community/tutorials/how-to-use-apache-http-server-as-reverse-proxy-using-mod_proxy-extension

我确实指定了我从letsencrypt 获得的证书文件（cert.pem）的来源

来源：https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04

注意：HTTPS在我的服务器中有效

我现在该怎么办？我只想让网络套接字通过HTTPS工作。

我使用的是Ubuntu 14.10，Apache 2.4.1安装的

我当前的配置文件：

<VirtualHost *:80>
    # The ServerName directive sets the request scheme, hostname and port that
    # the server uses to identify itself. This is used when creating
    # redirection URLs. In the context of virtual hosts, the ServerName
    # specifies what hostname must appear in the request's Host: header to
    # match this virtual host. For the default virtual host (this file) this
    # value is not decisive as it is used as a last resort host regardless.
    # However, you must set it for any further virtual host explicitly.
    #ServerName www.example.com

    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html
    ProxyPass /wss2/ ws://www.mysite.com:8080/  #Removed this line now
    ProxyPass /wss2/ wss://www.mysite.com:8080/
    # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
    # error, crit, alert, emerg.
    # It is also possible to configure the loglevel for particular
    # modules, e.g.
    #LogLevel info ssl:warn
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
    # For most configuration files from conf-available/, which are
    # enabled or disabled at a global level, it is possible to
    # include a line for only one particular virtual host. For example the
    # following line enables the CGI configuration for this host only
    # after it has been globally disabled with "a2disconf".
    #Include conf-available/serve-cgi-bin.conf
 RewriteEngine on
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [L,QSA,R=permanent]
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

提前谢谢。

Answer 1

我自己经过长时间的挣扎才明白。

在文件"/etc/apache2/mods-enabled/proxy_wsstunnel.load"中添加此行（使用您自己的名称和端口）。8000是我的websocket服务器运行的端口。

ProxyPass "/websocket"  "ws://localhost:8000/"

重新启动apache服务器。

然后在连接过程中使用如下URL：

socket = new WebSocket("wss://www.xyz.com/websocket"); 

其中xyz.com指向您的本地主机

就是这样。如果你想启用相应的模块，请使用apache的a2enmod

Answer 2

您需要一个额外的代理行，其中第二个参数是wss://URL，如mod_proxy_stunnel:的基本示例

https://httpd.apache.org/docs/2.4/mod/mod_proxy_wstunnel.html