Setup of https/ssl - local WebXR/Quest development

Hi There,

Just wanted to share my joy of setting up https on my local server using Node-RED.

I've had to setup ssl a couple times before and its always been a pain (Nginx/Apache configs, self-signing authority and/or let's encrypt with ACME endpoints ... ) and I was facing the same pains this morning when I needed SSL connection to my local machine, within my own local network. Why? Because WebXR only works[1] with https - eyes rolling.

So the scenario is that I want to render some 3D content in my Quest3 served from my local machine. To view this within the Quest, I'm using WebXR (via BabylonJS) and that requires a https source. (Up until now, I've been using a cloud server which is behind an https proxy.)

I was already dreading setting up something (aka a proxy) on a raspberry using apache or nginx .... but then I remembered that there was https support baked into Node-RED[2] ... so I thought ok, lets give it a whirl on the old FJ. Turns out it's dead simple ... once I discovered the three openssl commands from this page:

prompt> hostnme=server-name-in-my-local-dns-server
prompt> openssl genrsa -out ${hostnme}.key 2048
prompt> openssl req -key ${hostnme}.key -new -out ${hostnme}.csr
prompt> openssl x509 -signkey ${hostnme}.key -in ${hostnme}.csr -req -days 365 -out ${hostnme}.crt

that generates the two files that get used by Node-RED to create SSL connections, in the settings.js file:

    /** Option 1: static object */
    https: {
      key: require("fs").readFileSync('/data/server-name-in-my-local-dns-server.key'),
      cert: require("fs").readFileSync('/data/server-name-in-my-local-dns-server.crt')
    },

(/data here because this Node-RED is running in a docker image).

The ssl connection is available under the uiPort setting --> https://server-name-in-my-local-dns-server:1880/ i.e., there is no longer a http endpoint, only an ssl endpoint.

Opening that in my Quest and accepting the dangers of my own certificate (thankfully Meta didn't get rid of the "I accept the risk of using a self-signed certificate" option in the browser), e'voila, my Quest3 is now happy to render my 3D content :slight_smile:

Big thanks to everyone involved in making https so simple :+1:

[1]=strictly not, localhost is also possible but how do I start a server on a Quest3 to server my content - since localhost within the quest3 is the quest3 ... thanks Meta for thinking this one through!

[2]=it happens that my HTML content that renders the 3D scene is hosted in Node-RED - as a flow consisting of a bunch of template nodes

P.S: it's all been documented already but that seems to be for Let's Encrypt certificates ...

2 Likes

Another learning is that the http request node won't connect to a server with a self-signed SSL certificate:

Screenshot 2025-03-27 at 12.53.35

The fix is to provide a TLS configuration:

And in that TLS configuration the only thing to do is uncheck Verify server certificate (default checked):

ITE: Much ado about nothing.

1 Like