0

What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust?

FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on secureConnect, we can get fingerprints via getPeerCertificate() and compare against a hardcoded valid fingerprint like below.

Please see these references as well: 1. WSS, 2. HTTPS

const ws = new WebSocket(url);
const validFingerprint = 'CA:06:F5:6B:25:8B:7A:0D:4F:2B:05:47:09:39:47:86:51:15:19:84';

ws._req.on('socket', function (socket) {
  socket.on('secureConnect', function () {
    const { fingerprint } = socket.getPeerCertificate();

    if (fingerprint !== validFingerprint) ws.close();
  });
});

This was originally asked on Stack Overflow, but again asked here since no response was received.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.