I'm attempting to connect to a websocket server hosted in C# using SuperWebSockets from a page. The issue is that the websocket server generates a self-signed certificate making it difficult to connect to from the browser. The ServerConfig of the SuperWebSocket has "tls" for Security and passes on a self-signed certificate filepath through the Certificate member of the ServerConfig.

I was wondering if anyone knew any hacky tricks to connect to this web socket server from a web page, I'm open to ideas for either/both Firefox or Chrome. I know there are ways to do this if the user adds an exception for the certificate or disables certificate validation, but I need a method that's pure javascript. Perhaps emulating TLS?

  • It would help to help you if you can tell us whether you are hosting the server or just a consumer? – fossil Jun 10 at 3:19
  • @fossil I'm pentesting a piece of software which hosts it on my local machine. – Rob Gates Jun 10 at 3:19
  • You can consider creating your own certificate authority and create a server certificate for your server and add the CA certificate as trusted CA to your browsers. You can consider using a tool like sourceforge.net/projects/xca for managing your certificates. – fossil Jun 10 at 3:26
  • If having your own certificate works for you I can write an answer with detailed instructions. – fossil Jun 10 at 3:31
  • @fossil I cannot specify my own certificate. This software generates a new one on start everytime, I have no control over it. I am trying to see if it's possible to create an html page which can communicate with the software without user interaction, issue being that the websocket server has an invalid certificate. – Rob Gates Jun 10 at 3:33

There is no way to disable certificate validation or accept an invalid or self-signed certificate using pure Javascript in the browser. And it would be a very bad idea if something like this exists since it might enable attackers to man in the middle critical sites when you've visited the attackers site.

You might explicitly import the certificate as trusted in each browser or you might offer access to this site by HTTPS (i.e. not only wss://) so that the user can create an explicit exception for this site. But this can thankfully not be automated, i.e. it requires explicit user interaction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.