Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Accessing self signed code-server on iPad #1566

Closed
vmadykumar opened this issue Apr 28, 2020 · 57 comments
Closed

Accessing self signed code-server on iPad #1566

vmadykumar opened this issue Apr 28, 2020 · 57 comments
Labels
docs Documentation related
Milestone
v3.7.0

Comments

@vmadykumar
Copy link

i'm running code-server on https using custom image of code-server, i used existing certificate by providing the path to "--cert" and the path to its key with "--cert-key" as given documentation.

I used below command to run the code-server on https

sudo docker run -d -p 443:8080 -e PASSWORD="password@123" -v /home/ubuntu/ssl_certificate/wwwwww.crt:/home/coder/cert.crt -v /home/ubuntu/ssl_certificate/xxxxxxx.key:/home/coder/cert.key -v "$PWD:/home/coder/project" kkkkk/code-server --auth none --cert /home/coder/cert.crt --cert-key /home/coder/cert.key --proxy-domain *.yyyy.com

here in above command i'm copying my existing "certificate" and "key" from my local system to container and then passing that path in "--cert" and "--cert-key"

It's running on https and also redirecting all "http" request to "https" but the issue which is coming here is that the site in not secure even after provide correct certificate file.

what should i do to make it secure any help will be appreciated
@code-asher
Copy link
Member

Are you using a self-signed certificate? If so, you'll need to get a real one.

@nhooyr
Copy link
Contributor

nhooyr commented Apr 28, 2020

Can you elaborate on what you mean by not secure? Is HTTPS not active?

@nhooyr nhooyr added the waiting-for-info Waiting for more information from submitter label Apr 28, 2020
@dreamorosi
Copy link

Are you using a self-signed certificate? If so, you'll need to get a real one.

What if I'm running on LAN? As far as I know CA cannot sign .local domains.

@mbreese
Copy link

mbreese commented May 3, 2020

Are you using a self-signed certificate? If so, you'll need to get a real one.

What if I'm running on LAN? As far as I know CA cannot sign .local domains.

I'd assume you'd need to setup a local CA and add that to your OS. You should also be able to add self-signed certificates to your OS, such as shown here: https://www.humankode.com/asp-net-core/develop-locally-with-https-self-signed-certificates-and-asp-net-core

(Not tested)

@dreamorosi
Copy link

dreamorosi commented May 3, 2020 •
edited
Loading

Hello @mbreese, thanks for pitching in but the article you linked shares how to create a simple self-signed certificate (which is by definition not signed by a CA).

The problem here is not generating the certificate but the fact that in order to use code-server with iPadOS properly, an actual SSL certificate is needed.

My setup is a bit more involved than normal but basically I am running code-server on a Linux box that won’t have internet connection and would allow to use vscode via iPad connected through LAN. In this scenario having an actual certificate with a domain seems out of the question and while I understand the reasoning behind limiting certain features when a self signed cert is in place (MiM attacks and such) it would still be good to have an option for intranets.

@mbreese
Copy link

mbreese commented May 3, 2020 via email •
edited
Loading

@lisanet
Copy link

lisanet commented May 3, 2020

Since iPadOS / iOS 13 there are a few more requirements for TLS server certificates to be trusted by iPadOS / iOS See https://support.apple.com/en-us/HT210176

If using openssl to issue a certificate, this blog post might help for these requirements: http://blog.nashcom.de/nashcomblog.nsf/dx/more-strict-server-certificate-handling-in-ios-13-macos-10.15.htm?opendocument&comments

On macOS the certificate assistent in Keychain Access.app let's you easily create your own CA and issue the certificates.

@dreamorosi
Copy link

I have generated the certificate according to the specifications detailed by @lisanet (thanks a lot):

openssl req -x509 -nodes -days 399 -sha256 -newkey rsa:2048 -out /etc/ssl/localcerts/code.crt -keyout /etc/ssl/localcerts/code.key -config /etc/ssl/openssl.cnf -addext extendedKeyUsage=serverAuth -addext subjectAltName=DNS:raspberrypi.local

When I dump the certificate, as far as I can see, it complies to all the requirements (some parts have been redacted with ......, the actual certificate has actual values):

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ......
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = ES, L = Barcelona, O = Andre INC, CN = raspberrypi.local, emailAddress = ...@gmail.com
        Validity
            Not Before: May  3 15:26:21 2020 GMT
            Not After : Jun  6 15:26:21 2021 GMT
        Subject: C = ES, L = Barcelona, O = Andre INC, CN = raspberrypi.local, emailAddress = dreamorosi@gmail.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    ......
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                ......
            X509v3 Authority Key Identifier: 
                keyid:......

            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Subject Alternative Name: 
                DNS:raspberrypi.local
    Signature Algorithm: sha256WithRSAEncryption
         ...

I have then manually installed the certificate on the iPad as a profile and trusted it (thanks @mbreese) and now whenever I visit the host through Safari via HTTPS I don't get anymore any trust/security notice.

Unfortunately code-server shows me a white screen after login now but at least I know it's not a certificate issue as other issues claim.

@dreamorosi dreamorosi mentioned this issue May 3, 2020
Closed
@lisanet
Copy link

lisanet commented May 3, 2020 •
edited
Loading

You need to create your own CA and then create the TLS server certificate using your CA. The CA certificate has to be imported to iPadOS and has to be trusted as a profile and as a certification authority.

For use with code-server, add the CA certificate to the server certificate with
cat client.pem ca.pem > combined.pem
and use this combined.pem with code-servers --cert option.

That fixed the white screen issue on my iPad Pro, whereas only a single self-signed server certificate didn't work.

@dreamorosi
Copy link

Could you please elaborate on how to do so through Keychain Access.app?
I had already tried after your first post to create a CA and the certificate but then resorted to openssl. I tried again to create both using Keychain Access > Certificate Assistant but perhaps I'm doing something wrong because I end up with ca.pem and client.cer (that I need to convert into pem) before merging them into combined.pem

Besides, when trying to start code-server with the --cert key and passing the combined.pem it asks me for the key.

@lisanet
Copy link

lisanet commented May 3, 2020

Take a look at this: https://siber-sonic.com/mac/MailSMIME/CA.html although it seems outdated, it's still valid.

And please read some manual about openssl. openssl output is almost always in PEM format, so your *.crt is just a PEM file. (test it with the 'file client.crt' command). If it is not PEM, it's in DER format, which can be easily converted, see man openssl.

Well, if code-server complains about a missing key, add it with --cert-key client.key`

Every web server which uses TLS needs just 3 things. A server cert, the private key for this server cert, and the CA which has signed this server cert. Since code-server (and many others apps with included web servers) doesn't have an option to specify the CA cert, you need to combine it with the client cert. That's all.

@vmadykumar
Copy link
Author

Can you elaborate on what you mean by not secure? Is HTTPS not active?

HTTPS is active but it's showing unsecured connection while i'm browsing it on chrome.
i'm using valid certificate then also getting this unsecured connection warning. I resolved this issue while i used a valid url for this site insted of just browsing this site on IP address.

But my real problem is i need to use this inside my application where i will create new container of code-server on user request and this container will get created on azure container instance for each user separately. Now i tried to do this with "Enable a TLS endpoint in a sidecar container" using self-signed certificate and everything is working file except for the warning i'm getting of insecure connection. And this is a problem for me as my application is working on https it will not allow insecure site to get open inside it. Azure is only giving me one IP for browsing it's not giving me any DNS even if i'm giving "--dns-name-label" while i'm creating this container.

So is there any way i can make code-server secure just with IP address
cc

@mbreese
Copy link

mbreese commented May 5, 2020

It honestly sounds like you need to run this behind a reverse proxy. Then you can let the proxy handle the SSL termination and forwarding requests to your Azure containers. This is the easiest way to get SSL running with code-server anyway (IMO). You may still have issues with window.isSecureContext, but that will depend on how the proxy is setup.

To answer your specific question (and this is in no way code-server specific): you’re not going to get an IP address certificate issued to you for an ephemeral IP address you get from Azure. The only way you could potentially do it is with a self-signed CA certificate, but then you’ll still get end user warnings.

See this: https://www.geocerts.com/support/ip-address-in-ssl-certificate

You can have IP certificates, but no public CA would issue an IP certificate to an IP address you aren’t permanently assigned.

@nhooyr
Copy link
Contributor

nhooyr commented May 18, 2020

@lisanet Interesting, can you not add the self signed certificate as a trusted authority like you can on macOS?

@nhooyr nhooyr changed the title Running code-server over https Accessing self signed code-server on iPad May 18, 2020
@lisanet
Copy link

lisanet commented May 18, 2020

@lisanet Interesting, can you not add the self signed certificate as a trusted authority like you can on macOS?

I couldn't get it to work. I've tried using macOS certificate assistant to create a self signed root certificate with all needed extensions. Although the certificate looks okay in macOS keychain and can be trusted there, it couldn't be trusted as a root CA on iPadOS.

@nhooyr
Copy link
Contributor

nhooyr commented May 18, 2020

Awesome, will add this to the FAQ and guide then!

@dreamorosi
Copy link

That is interesting indeed, from the previous comments I was under the impression that it was supposed to work and tested and so I spent several hours trying to make it work.

@nhooyr Definitely something that should be added to the FAQs then!

@lisanet
Copy link

lisanet commented May 18, 2020

That is interesting indeed, from the previous comments I was under the impression that it was supposed to work and tested and so I spent several hours trying to make it work.

Reading my comment again, it might be somewhat misleading.

A single self signed root certificate with the extension (SAN and TLS server) to use as the server certificate couldn't be trusted in iPadOS as a root certificate.

Generating a root CA in macOS certificate assistant and then generating a server certificate (with the needed extensions) signed by this root CA certificate will work. The root CA cert can be trusted in iPadOS.

@nhooyr
Copy link
Contributor

nhooyr commented May 19, 2020

Added a link to @lisanet's comment in the FAQ: https://github.com/cdr/code-server/blob/629645f55530c532bec841114bfda92550636afb/doc/FAQ.md#blank-screen-on-ipad

#1678

@nhooyr nhooyr pinned this issue May 19, 2020
@nhooyr nhooyr mentioned this issue May 19, 2020
Closed
@LindsayWeir
Copy link

@lisanet I created a CA in Certificate Assistant on the Mac. I generated a CSR using OpenSSL including the SAN (changed below to xxxxx.local):

Requested Extensions:
X509v3 Subject Alternative Name:
DNS:xxxxxxx.local
X509v3 Key Usage:
Digital Signature, Key Encipherment, Data Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication

The problem I seem to have is when I "Create a Certificate For Someone Else" in Certificate Assistant, it doesn't appear to honor the SAN entry in the generated certificate. Wondering if you saw this at all when you were working through this?

@lisanet
Copy link

lisanet commented May 26, 2020

@LindsayWeir I didn't use a CSR.

I used in Certificate Assistant just the "Create a Certificate" menu item with an identity type of "Leaf" and "Certificate Type" of SSL-Server and checked the "let me override defaults" to get to the extended key usage options to fill in the DNS name.

@LindsayWeir
Copy link

Thanks Lisa, I was trying to use a CSR generated from OpenSSL. Let me try your way and see if that works.

@LindsayWeir
Copy link

@lisanet I was able to get the certificate signed and generated correctly. This is using .local for the signed certification. Were you seeing issues with copy/paste on the iPad after you got this all working? Any insights or workarounds? Thanks

@lisanet
Copy link

lisanet commented May 27, 2020

nope, I couldn't get copy / paste to work.

@zkghost
Copy link

zkghost commented May 31, 2020

I have tried all day to get copy/paste to work with no luck. This is super fuckin’ frustrating, can we just have an override option to allow forcing the session to be considered secure???

@DAddYE
Copy link

DAddYE commented Aug 26, 2020

Thanks @DAddYE. Is there any guide on how to do that? I'm assuming I need recompile it with the changes but I used the install script on a ubuntu vm. Works on my side with LetsEncrypt I didnt even need to import the CA certs to my ipad. My copy paste isnt working from within vscode but I'm guessing your fix would do it.

They have good guides here: https://github.com/cdr/code-server/blob/v3.4.1/doc/CONTRIBUTING.md#build

The upstream vscode on July 3 pushed the fix posted above microsoft/vscode@b3fba74, however, no idea when will land on here.

@DAddYE
Copy link

DAddYE commented Aug 26, 2020

@snazzybunny you have to edit lib/vscode/src/vs/editor/browser/controller/textAreaHandler.ts, comment/remove line 186:

if (browser.isIPad) {                                                                                           
       // Do not place anything in the textarea for the iPad                                                   
       // return TextAreaState.EMPTY;                                                                          
}

No clue why they had such return TextAreaState.EMPTY in the first place.

NOTE: On the very very last iOS beta, I think there is a bug in the os, if you copy/paste within vscode works, but if you copy from an app to another, most of the time doesn't work (I think is the new privacy thing), however, a simple cmd+shift+v solve the trick.

The copy/paste bug disappeared in the latest beta.

@snazzybunny
Copy link

@DAddYE thanks for pointing me in the right direction. Everything seems to be working fine now after the edit and update to latest beta!

@nhooyr nhooyr added docs Documentation related and removed waiting-for-info Waiting for more information from submitter labels Aug 31, 2020
@snazzybunny
Copy link

@DAddYE I noticed that there is no paste button on Windows or Mac. It does however appear on the ipad. I suppose the code-server should strictly be for the ipad eh. Has anyone had the same issue where the paste button doesn't appear when you right click? Thanks.

@DAddYE
Copy link

DAddYE commented Sep 2, 2020 via email

@Immortalin
Copy link

Immortalin commented Sep 8, 2020 •
edited
Loading

There is an easy way to fix most of the above issues without any custom CA hacks. Point your domain (or sub domain) at your internal ip (such as SSH tunnels, one of those BeyondCorp VPNs like Zerotier or Tailscale, or simply localhost). Then in Caddy activate DNS-01 challenge. This does not require Caddy to be actually reachable at the domain, it just has to call the API of your registrar using one of the modules such as https://github.com/caddy-dns/cloudflare. The DNS registrar can be thought as a key-value store, your browser would be able to resolve and access the internal ip but nobody else can.

@doug-sheridan
Copy link

FYI, I self-signed a certificate on iOS 14 and seems working well, you have to enable full permissions to the certificate, but other that works as expected.

Do you have a guide for this @DAddYE ?

Yes, I followed this: https://7402.org/blog/2019/new-self-signed-ssl-cert-ios-13.html

Do not forget a few things:

1. From iPad don't use the local ip rather the `local-name.local` to reach your https server.

2. If out of network setup a tunnel with `Blink` (terminal for iPad) or similar apps, pay attention that only Blink has the ability to run in background and keep the tunnel open (see their docs for how to but you need to enable location tracking).

3. Once you install the certificate, don't forget to go to "Settings->General->Profiles" and enable `full access` to the new installed profile.

4. Add a home shortcut to enjoy a rather nice full screen experience:
PNG image

I hope it helps!

@DAddYE I ended up following your advice and the instructions you linked from 7402.org and this was working great for iOS 13, but now that I've updated my device to iOS 14 my certs no longer pass validation. Did you have any issues getting certs to pass on your iOS 14 devices?

  • I already enabled full trust for the root cert from Settings > About > Certificate Trust Settings
  • This was working in iOS 13.7 but not iOS 14

Please take a look at my openssl config:

[ ca ]
default_ca = CA_default

[ CA_default ]
default_md = sha256
default_days = 397
x509_extensions	= usr_cert

[ req ]
default_bits		= 4096
default_md		= sha256
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca
copy_extensions = copy

[ usr_cert ]
basicConstraints=CA:TRUE

[ v3_req ]
basicConstraints = CA:TRUE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]
basicConstraints = CA:TRUE
subjectAltName = DNS:10.0.1.10
extendedKeyUsage = serverAuth

[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_min			= 2
countryName_max			= 2
stateOrProvinceName		= State or Province Name (full name)
localityName			= Locality Name (eg, city)
0.organizationName		= Organization Name (eg, company)
organizationalUnitName		= Organizational Unit Name (eg, section)
commonName			= Common Name (eg, fully qualified host name)
commonName_max			= 64
emailAddress			= Email Address
emailAddress_max		= 64

[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20

@snazzybunny
Copy link

snazzybunny commented Sep 23, 2020 •
edited
Loading

Hmm I did not need to add any CAs to my Ipad and everything is working fine except scrolling. Copy, cut and paste works as well. I have a reverse proxy nginx server with LetsEncrypt. Copied the certs from the nginx server to my code-server machine and added this to my config.yaml in ~/.config/code-server:

cert: /home/meow/.code-server-meta/cert.pem
cert-key: /home/meow/.code-server-meta/key.pem

You need to obviously change the cert and cert-key location to wherever your LetsEncrypt cert and key is located.

Anyone else here have issues with scrolling using a magic keyboard? I have to manually click on the scroll bar and drag in order to scroll. Alternatively you can press cmd+down, which mimics the page down button.

I updated by checking out the latest version and packaged it then installed the new .deb file and it updated from 3.4.1 to 3.5.0. All extensions and settings were preserved as theyre stored in ~/.local/share/code-server.

@DAddYE
Copy link

DAddYE commented Sep 28, 2020 via email •
edited
Loading

@cmoog
Copy link
Contributor

cmoog commented Oct 13, 2020

We’re making it easier to access your code-server instance securely from any device. We’ve eliminated the need for configuring TLS, domain registration, DNS, DoS protection, and authentication. To gain pre-release access, please consider joining our alpha program.

cc @DAddYE @mbreese @Tehnix @lisanet @dsherida @dreamorosi

nhooyr added a commit that referenced this issue Oct 30, 2020
@nhooyr
src/node/util.ts: Make certificate generation "modern"
bd2d1b5 
Now we add a subject alt name, set extendedKeyUsage and use the
correct certificate extension.

The above allow it to be properly trusted by iOS.

See https://support.apple.com/en-us/HT210176

*.cert isn't a real extension for certificates, *.crt is correct
for it to be recognized by e.g. keychain or when importing as a profile
into iOS.

Updates #1566

I've been able to successfully connect from my iPad Pro now to my
code-server instance with a self signed certificate! Next commit
will be docs.
nhooyr added a commit that referenced this issue Oct 30, 2020
@nhooyr
wip iPad docs
68d3752 
Closes #1816
Closes #1566
nhooyr added a commit that referenced this issue Oct 30, 2020
@nhooyr
src/node/util.ts: Make certificate generation "modern"
6f5d492 
Now we add a subject alt name, set extendedKeyUsage and use the
correct certificate extension.

The above allow it to be properly trusted by iOS.

See https://support.apple.com/en-us/HT210176

*.cert isn't a real extension for certificates, *.crt is correct
for it to be recognized by e.g. keychain or when importing as a profile
into iOS.

Updates #1566

I've been able to successfully connect from my iPad Pro now to my
code-server instance with a self signed certificate! Next commit
will be docs.
nhooyr added a commit that referenced this issue Oct 30, 2020
@nhooyr
docs: Add iPad self signed certificate documentation
3d37d2c 
Closes #1816
Closes #1566
nhooyr added a commit that referenced this issue Oct 30, 2020
@nhooyr
docs: Add iPad self signed certificate documentation
096e762 
Closes #1816
Closes #1566
nhooyr added a commit that referenced this issue Oct 30, 2020
@nhooyr
docs: Add iPad self signed certificate documentation
0807dd9 
Closes #1816
Closes #1566
nhooyr added a commit that referenced this issue Oct 30, 2020
@nhooyr
src/node/util.ts: Make certificate generation "modern"
8b85006 
Now we add a subject alt name, set extendedKeyUsage and use the
correct certificate extension.

The above allow it to be properly trusted by iOS.

See https://support.apple.com/en-us/HT210176

*.cert isn't a real extension for certificates, *.crt is correct
for it to be recognized by e.g. keychain or when importing as a profile
into iOS.

Updates #1566

I've been able to successfully connect from my iPad Pro now to my
code-server instance with a self signed certificate! Next commit
will be docs.
nhooyr added a commit that referenced this issue Oct 30, 2020
@nhooyr
docs: Add iPad self signed certificate documentation
dc95d19 
Closes #1816
Closes #1566
nhooyr added a commit that referenced this issue Nov 3, 2020
@nhooyr
docs: Add iPad self signed certificate documentation
31306f7 
Closes #1816
Closes #1566
@bpmct bpmct unpinned this issue Nov 9, 2020
@bpmct bpmct pinned this issue Nov 9, 2020
@nhooyr
Copy link
Contributor

nhooyr commented Nov 13, 2020

This has been done and will be in the next release!

@nhooyr nhooyr added this to the v3.6.3 milestone Nov 13, 2020
@nhooyr
Copy link
Contributor

nhooyr commented Nov 13, 2020

See https://github.com/cdr/code-server/blob/master/doc/ipad.md#how-to-access-code-server-with-a-self-signed-certificate-on-ipad

@nhooyr nhooyr closed this as completed Nov 13, 2020
@nhooyr nhooyr unpinned this issue Nov 23, 2020
@tauceti82
Copy link

You need to create your own CA and then create the TLS server certificate using your CA. The CA certificate has to be imported to iPadOS and has to be trusted as a profile and as a certification authority.

For use with code-server, add the CA certificate to the server certificate with
cat client.pem ca.pem > combined.pem
and use this combined.pem with code-servers --cert option.

That fixed the white screen issue on my iPad Pro, whereas only a single self-signed server certificate didn't work.

Thanks! yes that's what I did and it works on desktop browser but on ipad I only get:
error vscode Handshake timed out {"token":"cfc40654-0ee9-4a06-ac12-2509e50884a0"}

and a blank screen :(

ca certificate is imported in ios and trust root enabled.
It also works for other server certificates I have

@jsjoeio
Copy link
Contributor

jsjoeio commented Mar 29, 2021

Hi @tauceti82 - sorry to hear you're still having issues! Feel free to open a new bug report issue and we'll see if we can help. Otherwise, feel free to open a Discussion if you need further help!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
docs Documentation related
Projects
None yet
Milestone
v3.7.0
Development

No branches or pull requests