0

I have a local http service application running on OSX (hosted through Mono/OWIN) that I want to access on https instead. The service itself is easily configured to require https, but the local bit is causing trouble.

On Windows I solved this by binding an SSLCert to the local port with the command

netsh http add sslcert ipport=0.0.0.0:8000 appid={xyzw} certhash=XYZW

which then means any access to https://127.0.0.1:8000 is verified against the given certificate and allowed.

I have no idea where to look for the OSX equivalent though. Most references to SSL certificates are in the context of Apache, which is not involved in my use case, and tools like iwconfig or others I've looked at don't seem to have the required functionality.

Improve this question
3
  • How is your signalR service accepting incoming connections? What is opening the socket, listening, and accepting connections? – Graham Miln May 3 '16 at 16:27
  • SignalR starts a web server (asp.net, I believe), and then the client connects (with a browser or from visiting another web-page that starts a session) to 127.0.0.1:8000/signalr/hubs serves up jquery code to connect to the signalR hub. I've got a certificate for a specific domain and an entry in the hosts file to resolve that particular domain to 127.0.0.1. – Joris Timmermans May 3 '16 at 17:03
  • To enable https support, SSL/TLS, you need to have the web server started by SignalR manage the encryption and certificates. Alternatively, try stunnel mentioned in the answer below – this is precisely the type of situation stunnel and reverse-proxies are design for. – Graham Miln May 3 '16 at 17:50
1

In OS X, the process responsible for accepting incoming connections is responsible for setting up and enforcing SSL/TLS. In most cases this will be a web server like Apache's httpd or nginx.

Take a look at SignalR and HTTPS for links and help to enable SSL support in signalR services.

Stunnel

If you can not enable SSL within your service, consider using stunnel:

Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code. Its architecture is optimized for security, portability, and scalability (including load-balancing), making it suitable for large deployments.

Install with brew

stunnel is available through Homebrew. Once brew is installed, install stunnel using:

brew install stunnel
Improve this answer
4
  • The article linked through that SignalR & HTTPS post actually mentions the exact netsh http add command that I use on Windows - "Finally you need to configure the machine to associate the certificate you just created, with the port and ip address that the HttpListener is listening on for https requests.". That's what I'm trying to do. – Joris Timmermans May 3 '16 at 15:44
  • I do not believe OS X has an netsh equivalent built-in. The process accepting the connection needs to deal with establishing a secure connection. Consider using stunnel or proxying the service behind httpd. – Graham Miln May 3 '16 at 16:19
  • 1
    I will try stunnel, it might be the lowest-pain-threshold solution for my problem. – Joris Timmermans May 4 '16 at 8:15
  • I have extended the answer to mention stunnel is available through brew. – Graham Miln May 4 '16 at 9:36
1

I have discovered the answer myself after some lucky digging and determining the right question to ask (as so often is the case!).

It turns out there is a tool for Mono that allows you to do what the Windows 'netsh http add' does:

httpcfg --add -port <portnum> -p12 <certfile.p12>

See also

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .