I am trying to get fastify listen on port 3000 for https requests . Fastify is listening on port 3000 , but when I am trying to send a curl command curl -k https://example.com:3000/ -v , I am getting this
Trying 35.245.34.146...
* TCP_NODELAY set
* Connected to example.com (35.245.34.146) port 3000 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
* Closing connection 0
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
I setup tcpdump to capture traffic on port 3000 and here is what I got
14:11:23.046591 IP 100.8.170.2.52475 > 10.150.0.2.3000: tcp 0
0x0000: 4500 0040 0000 4000 3a06 2816 6408 aa02 E..@..@.:.(.d...
0x0010: 0a96 0002 ccfb 0bb8 2524 14bd 0000 0000 ........%$......
0x0020: b002 ffff 6070 0000 0204 05b4 0103 0306 ....`p..........
0x0030: 0101 080a 4ad5 607f 0000 0000 0402 0000 ....J.`.........
14:11:23.046638 IP 10.150.0.2.3000 > 100.8.170.2.52475: tcp 0
0x0000: 4500 003c 0000 4000 4006 221a 0a96 0002 E..<..@.@.".....
0x0010: 6408 aa02 0bb8 ccfb 2b60 9883 2524 14be d.......+`..%$..
0x0020: a012 fd00 18d1 0000 0204 058c 0402 080a ................
0x0030: 9e6d c7ce 4ad5 607f 0103 0307 .m..J.`.....
14:11:23.066491 IP 100.8.170.2.52475 > 10.150.0.2.3000: tcp 0
0x0000: 4500 0034 0000 4000 3a06 2822 6408 aa02 E..4..@.:.("d...
0x0010: 0a96 0002 ccfb 0bb8 2524 14be 2b60 9884 ........%$..+`..
0x0020: 8010 0814 6de8 0000 0101 080a 4ad5 6092 ....m.......J.`.
0x0030: 9e6d c7ce .m..
14:11:23.086786 IP 100.8.170.2.52475 > 10.150.0.2.3000: tcp 235
0x0000: 4500 011f 0000 4000 3a06 2737 6408 aa02 E.....@.:.'7d...
0x0010: 0a96 0002 ccfb 0bb8 2524 14be 2b60 9884 ........%$..+`..
0x0020: 8018 0814 432f 0000 0101 080a 4ad5 60a7 ....C/......J.`.
0x0030: 9e6d c7ce 1603 0100 e601 0000 e203 03da .m..............
0x0040: 6cf3 41d6 0aba 42c3 5e03 d368 bb85 d01c l.A...B.^..h....
0x0050: 576a 3ce9 e7b8 208f 49d6 0c28 094d 5000 Wj<.....I..(.MP.
0x0060: 005c c030 c02c c028 c024 c014 c00a 009f .\.0.,.(.$......
0x0070: 006b 0039 cca9 cca8 ccaa ff85 00c4 0088 .k.9............
0x0080: 0081 009d 003d 0035 00c0 0084 c02f c02b .....=.5...../.+
0x0090: c027 c023 c013 c009 009e 0067 0033 00be .'.#.......g.3..
0x00a0: 0045 009c 003c 002f 00ba 0041 c011 c007 .E...<./...A....
0x00b0: 0005 0004 c012 c008 0016 000a 00ff 0100 ................
0x00c0: 005d 0000 0015 0013 0000 1075 7064 6174 .].......example
0x00d0: 6573 6469 6172 792e 636f 6d00 0b00 0201 .com.....
0x00e0: 0000 0a00 0800 0600 1d00 1700 1800 0d00 ................
0x00f0: 1c00 1a06 0106 03ef ef05 0105 0304 0104 ................
0x0100: 03ee eeed ed03 0103 0302 0102 0300 1000 ................
0x0110: 0e00 0c02 6832 0868 7474 702f 312e 31 ....h2.http/1.1
14:11:23.086829 IP 10.150.0.2.3000 > 100.8.170.2.52475: tcp 0
0x0000: 4500 0034 6647 4000 4006 bbda 0a96 0002 E..4fG@.@.......
0x0010: 6408 aa02 0bb8 ccfb 2b60 9884 2524 15a9 d.......+`..%$..
0x0020: 8010 01f9 18c9 0000 0101 080a 9e6d c7f7 .............m..
0x0030: 4ad5 60a7 J.`.
fastify setup
const fs = require('fs');
const path = require('path');
const fastify = require('fastify')(
{ logger: true},
{
http2: true,
https: {
cert: fs.readFileSync(path.resolve(__dirname,'../../etc/letsencrypt/live/example.com/cert.pem')),
key: fs.readFileSync(path.resolve(__dirname,'../../etc/letsencrypt/live/example.com/privkey.pem')),
secureProtocol: 'TLSv1.2'
}
}
);
http works fine curl -k http://example.com:3000/ -v and i get response back
I have also tried making this change in /etc/apache2/sites-enabled/000-default-le-ssl.conf in `
<VirtualHost *:443 *:3000>
but I get same result CONNECT_CR_SRVR_HELLO:wrong version number in curl command
can someone please help to see how can I get response back for https?
I implemented ProxyPassReverse from Apache to achieve fastify sending requests over https using the same apache tunnel that is already opened (port 443) instead of opening a different port
Include this in your /etc/apache2/sites-enabled/000-default-le-ssl.conf file on apache2
ProxyPreserveHost On
ProxyPass /path http://127.0.0.1:3000/path1
ProxyPassReverse /path http://127.0.0.1:3000/path1
where /path is path from incoming request from client (browser) and /path1 is the path that will be located on Fastify server
On fastify side , your server.js will look like thuis in its very basic form
fastify.register(httpProxy, {
upstream: 'https://upstream.com',
prefix: '/path1',
});
make sure fastify listens on 3000, no need to get fastify listen on https in this setup
Finally ,an example , the request from client will look like this.
https://yourdomain.com/path/svc/search and in this setup it will be proxied to https://upstream.com/svc/search