# Node-red dashboard and user certificate

**URL:** <https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470>\
**Category:** Dashboard\
**Created:** [25 April 2020 10:08 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470 "2020-04-25T10:08:32Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![mharizanov](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mharizanov/32/20626_2.png) [@mharizanov](https://discourse.nodered.org/u/mharizanov)\
**Post date:** [25 April 2020 10:08 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/1 "2020-04-25T10:08:32Z")

</div>

Hi,  
I have my node-red secured with mutual TLS authentication, upon navigating to _[https://mydomain.com:1880](https://mydomain.com:1880)_ I am requested to present a user certificate and all works as expected. However, if I first navigate to the node-red powered dashboard at _[https://mydomain:1880/ui](https://mydomain:1880/ui)_ there is no prompt to request the user certificate and the screen remains blank, no errors are displayed. If I navigate to node-red control UI first (it asks for user cert), and then navigate to the dashboard URL it works fine.

My settings.js is something like this:

```auto
    https: {
        ca: fs.readFileSync('ca-chain.crt.pem'),
        cert: fs.readFileSync('tld.crt.pem'),
        key: fs.readFileSync('private.key.pem'),
        requestCert: true,
        rejectUnauthorized: true,
    },

```

Looking at the console output:

```auto
/ui/socket.io/socket.io.js.map: Connection error: net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED

```

Any tips to get this to work properly e.g. upon navigating to /ui it should prompt for user certificate?

---

<div class="post-metadata">

**Author:** ![jodelkoenig](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jodelkoenig/32/44645_2.png) [@jodelkoenig](https://discourse.nodered.org/u/jodelkoenig)\
**Post date:** [25 April 2020 10:18 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/2 "2020-04-25T10:18:18Z")

</div>

Interesting. Exactly the same applies to nginx as a proxy in front of my nodered docker stack, while nodered still runs (in the back) via http.

---

<div class="post-metadata">

**Author:** ![mharizanov](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mharizanov/32/20626_2.png) [@mharizanov](https://discourse.nodered.org/u/mharizanov)\
**Post date:** [27 April 2020 07:06 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/3 "2020-04-27T07:06:39Z")

</div>

The same effect is observable for https in node , so I suspect the issue is more generic, probably not "dashboard" specific problem.  
My guess is that https nodes do not respect the settings.js _requestCert: true_

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [27 April 2020 11:36 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/4 "2020-04-27T11:36:59Z")

</div>

Hi Martin, it's good to see you here in the node-RED forum, it's been a while since I've heard from you (although I don't spend much time doing emoncms work now).

I hope you are going to sprinkle some of your programming magic here. 👍

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [2 May 2020 20:36 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/5 "2020-05-02T20:36:39Z")

</div>

This seems to imply that the requestCert setting is also being applied to the [Socket.IO](http://Socket.IO) connection but the [socket.io](http://socket.io) client isn't configured to provide it?

As you may know, a websocket connection firstly happens over http (https in this case) and is then "upgraded" to ws(s).

There appear to be a couple of clues here:

- [https://stackoverflow.com/questions/25786958/socket-io-how-to-read-client-certificate](https://stackoverflow.com/questions/25786958/socket-io-how-to-read-client-certificate)
- [https://github.com/socketio/socket.io-client/issues/551](https://github.com/socketio/socket.io-client/issues/551)

Possibly needs a tweak to the Dashboard code to allow this to work? @dceejay, do you know?

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 May 2020 07:19 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/6 "2020-05-03T07:19:33Z")

</div>

> [@mharizanov](#):
>
> The same effect is observable for https in node

Hi Martin,  
Would like to help you, but I don't have enough knowledge about the Node-RED architecture...  
For example for the HttpIn node, I "think" this flow is being followed at startup:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/b/7/b774113193506aba8075ee31ad863b43e860c548.png)

1. Node-RED is started on Node
2. An express webserver is started
3. The settings.js file is executed
4. Your https settings are passed to the https module, so from now I would expect these settings would be applied to both the flow editor and the dashboard?
5. The runtime (available as the `RED` variable) is initialized. It seems to me that two new Express servers are started? But not sure...
6. The runtime is started, so all nodes of your flows are loaded (also your Http-in nodes).
7. The Http-in node starts listening to requests on the Express called `RED.httpNode`, which is the `nodeApp` variable in the runtime (index.js).

Hopefully anybody can explain this a bit more in detail to us, so we can start brainstorming about why your https settings are not applied to the Http-In nodes...

At the moment it is not clear to me how the https module and all the express modules are related to each other...

Bart

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [3 May 2020 16:56 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/7 "2020-05-03T16:56:47Z")

</div>

This seems to be where the socket connection is made on the client side.

> <https://github.com/node-red/node-red-dashboard/blob/master/src/services/events.js#L8>

You could try perhaps amending the start to include the client certificate request. Trouble is that you would also have to do a re-build as well.

---

<div class="post-metadata">

**Author:** ![mharizanov](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mharizanov/32/20626_2.png) [@mharizanov](https://discourse.nodered.org/u/mharizanov)\
**Post date:** [3 May 2020 18:37 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/8 "2020-05-03T18:37:27Z")

</div>

Thanks for the pointers.  
I spent the last couple hours in futile attempts to fix it using the above suggestions but obviously fiddling with node-red internals is too much of a challenge at this point.

A simple workaround: creating a "_dash.html_" in "_~/.node-red/node\_modules/node-red-dashboard/dist_" that only contains a meta tag redirect to _[https://mydomain:1880/ui](https://mydomain:1880/ui)_ and pointing my browser to _[https://mydomain:1880/ui/dash.html](https://mydomain:1880/ui/dash.html)_ causes Chrome to require me to present a client certificate and the dashboard loads. Not a complete "Feng Shui", but it does the job until the issue is fixed eventually.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [3 May 2020 22:32 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/9 "2020-05-03T22:32:44Z")

</div>

OK I have tried to follow along - and have pushed a small fix to the dashboard master branch on github for you all to try - it attempts to set the socket to use secure:true when using https protocol (which it should have done automatically - but...)

---

<div class="post-metadata">

**Author:** ![mharizanov](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mharizanov/32/20626_2.png) [@mharizanov](https://discourse.nodered.org/u/mharizanov)\
**Post date:** [4 May 2020 09:23 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/10 "2020-05-04T09:23:22Z")

</div>

It works perfectly for me - thank you!

ref: [https://github.com/node-red/node-red-dashboard/commit/08fdac5f2c88087d708f62526c97e24456c2da01](https://github.com/node-red/node-red-dashboard/commit/08fdac5f2c88087d708f62526c97e24456c2da01)

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [4 May 2020 10:35 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/11 "2020-05-04T10:35:10Z")

</div>

Great - I'll probably push it out later this week after some other testing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [18 May 2020 10:35 UTC](https://discourse.nodered.org/t/node-red-dashboard-and-user-certificate/25470/12 "2020-05-18T10:35:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.