给RocketChat开启HTTPS/SSL支持手机App访问

r囧r小猫 2021-12-12 00:31 1351阅读 0赞

### 文章目录 ###

*  给RocketChat开启HTTPS/SSL支持手机App访问
 *   *  给RocketChat server开启HTTPS/SSL
     *   *  生成SSL证书
         *  为Nginx配置SSL证书
         *  配置Nginx HTTPS反向代理
     *  测试HTTPS访问
     *   *  RocketChat Web App
         *  RocketChat客户端
         *  RocketChat iOS App
     *  参考文档

# 给RocketChat开启HTTPS/SSL支持手机App访问 #

在一台有公网访问的服务器上安装了RocketChat server，通过网页App和客户端访问都没有问题，但是通过苹果手机RocketChat App，却提示SSL错误无法连接。原因是RokcetChat手机App只能通过HTTPS方式访问RocketChat server。

## 给RocketChat server开启HTTPS/SSL ##

这里采取的做法是，在Nginx中使用自签名SSL证书，再把HTTPS请求反向代理到RocketChat server。

如果还没有安装Nginx，请参见：

*  [https://github.com/cookcodeblog/OneDayDevOps/blob/master/components/nginx/install\_nginx.sh][https_github.com_cookcodeblog_OneDayDevOps_blob_master_components_nginx_install_nginx.sh]

### 生成SSL证书 ###

生成自签名SSL证书，请参见：

*  [https://github.com/cookcodeblog/OneDayDevOps/blob/master/components/ssl/create\_self\_signed\_cert.sh][https_github.com_cookcodeblog_OneDayDevOps_blob_master_components_ssl_create_self_signed_cert.sh]
 *  [使用OpenSSL生成自签名SSL证书][OpenSSL_SSL]

示例：

./create_self_signed_cert.sh "/C=CN/ST=Guangdong/L=Guangzhou/O=xdevops/OU=xdevops/CN=<rocketchat_ip>"

### 为Nginx配置SSL证书 ###

复制上面生成的秘钥和 CA证书到Nginx：

cp server.key /etc/nginx/certificate.key
    cp server.crt /etc/nginx/certificate.crt

设置秘钥文件权限：

chmod 400 /etc/nginx/certificate.key

生成ssl\_dhparam文件：

sudo openssl dhparam -out /etc/nginx/dhparams.pem 2048

### 配置Nginx HTTPS反向代理 ###

编辑`nginx.conf`文件，配置HTTPS反向代理：

# HTTPS Server
        server { 
            listen 443 ssl;
            server_name <rocketchat_ip>;
    
            error_log /var/log/nginx/rocketchat_error.log;
    
            ssl_certificate /etc/nginx/certificate.crt;
            ssl_certificate_key /etc/nginx/certificate.key;
            ssl_dhparam /etc/nginx/dhparams.pem;
            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
            ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
            ssl_prefer_server_ciphers on;
            ssl_session_cache shared:SSL:20m;
            ssl_session_timeout 180m;
    
            location / { 
                proxy_pass http://<rocketchat_ip>:<rocketchat_port>/;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forward-Proto http;
                proxy_set_header X-Nginx-Proxy true;
                proxy_redirect off;
            }
        }

检查Nginx配置文件并让修改后的配置文件生效：

nginx -t
    nginx -s reload

## 测试HTTPS访问 ##

### RocketChat Web App ###

在浏览器中打开RocketChat Web App来测试HTTPS访问。

### RocketChat客户端 ###

打开RocketChat客户端添加HTTPS RocketChat server来测试HTTPS访问。

### RocketChat iOS App ###

将上面生成的CA证书（`certificate.crt`）放到一个公网可以访问的地址。

在苹果手机上下载安装和配置CA证书：

1.  打开Safari浏览器，访问该地址来下载CA证书。
2.  打开【设置】 ／ 【通用】 ／ 【描述文件】，安装该CA证书。
3.  打开【设置】 ／ 【通用】 ／ 【关于本机】/ 【证书信任设置】，开启刚才安装的证书

然后打开RocketChat手机App，添加RocketChat server：`https://<rocketchat_ip>:<rocketchat_port>` 来测试HTTPS访问

## 参考文档 ##

*  [https://rocket.chat/docs/installation/docker-containers/\#5b-self-signed-ssl][https_rocket.chat_docs_installation_docker-containers_5b-self-signed-ssl]
 *  [https://github.com/RocketChat/Rocket.Chat/issues/1927][https_github.com_RocketChat_Rocket.Chat_issues_1927]
 *  [https://rocket.chat/docs/developer-guides/mobile-apps/supporting-ssl/][https_rocket.chat_docs_developer-guides_mobile-apps_supporting-ssl]
 *  [https://developer.apple.com/library/archive/qa/qa1948/\_index.html\#//apple\_ref/doc/uid/DTS40017603-CH1-SECINSTALLING][https_developer.apple.com_library_archive_qa_qa1948_index.html_apple_ref_doc_uid_DTS40017603-CH1-SECINSTALLING]

[https_github.com_cookcodeblog_OneDayDevOps_blob_master_components_nginx_install_nginx.sh]: https://github.com/cookcodeblog/OneDayDevOps/blob/master/components/nginx/install_nginx.sh
[https_github.com_cookcodeblog_OneDayDevOps_blob_master_components_ssl_create_self_signed_cert.sh]: https://github.com/cookcodeblog/OneDayDevOps/blob/master/components/ssl/create_self_signed_cert.sh
[OpenSSL_SSL]: https://blog.csdn.net/nklinsirui/article/details/89432430
[https_rocket.chat_docs_installation_docker-containers_5b-self-signed-ssl]: https://rocket.chat/docs/installation/docker-containers/#5b-self-signed-ssl
[https_github.com_RocketChat_Rocket.Chat_issues_1927]: https://github.com/RocketChat/Rocket.Chat/issues/1927
[https_rocket.chat_docs_developer-guides_mobile-apps_supporting-ssl]: https://rocket.chat/docs/developer-guides/mobile-apps/supporting-ssl/
[https_developer.apple.com_library_archive_qa_qa1948_index.html_apple_ref_doc_uid_DTS40017603-CH1-SECINSTALLING]: https://developer.apple.com/library/archive/qa/qa1948/_index.html#//apple_ref/doc/uid/DTS40017603-CH1-SECINSTALLING