Skip to content

Feature: Enable self-signed certificates #1973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
blitztide wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Feature: Enable self-signed certificates #1973

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5a97f16
Feature: Enable self-signed certificates
blitztide Aug 1, 2025
c7cf101
Bugfix: extra checks and removing forced SSL
Sep 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions utils/novnc_proxy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ usage() {
echo " Default: 6080 (on all interfaces)"
echo " --vnc VNC_HOST:PORT VNC server host:port proxy target"
echo " Default: localhost:5900"
echo " --self-sign hostname Generate self-signed certificates for hostname"
Copy link
Copy Markdown
Contributor

@CendioZeijlon CendioZeijlon Sep 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't it be better to not force users to provide the hostname argument here? If they care enough, they will probably generate a more detailed certificate.

Copy link
Copy Markdown
Author

@blitztide blitztide Sep 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What would you suggest for the default value?

Copy link
Copy Markdown
Author

@blitztide blitztide Sep 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was using it to point to something behind a reverse proxy, for testing, so hostname is pretty critical for this.
Once fully set up, then a proper SSL would be generated.

Copy link
Copy Markdown
Contributor

@CendioZeijlon CendioZeijlon Sep 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest something equally generic to the other properties like CN=noVNC-host or perhaps CN=${HOSTNAME} if that environment variable is set.

I was using it to point to something behind a reverse proxy, for testing, so hostname is pretty critical for this.
Once fully set up, then a proper SSL would be generated.

Why is CN in the certificate important in this case?

echo " Requires OpenSSL to be installed"
Comment thread
blitztide marked this conversation as resolved.
echo " --cert CERT Path to combined cert/key file, or just"
echo " the cert file if used with --key"
echo " Default: self.pem"
Expand Down Expand Up @@ -51,6 +53,7 @@ HOST=""
PORT="6080"
LISTEN="$PORT"
VNC_DEST="localhost:5900"
SELF_SIGN=""
CERT=""
KEY=""
WEB=""
Expand Down Expand Up @@ -90,6 +93,7 @@ while [ "$*" ]; do
case $param in
--listen) LISTEN="${OPTARG}"; shift ;;
--vnc) VNC_DEST="${OPTARG}"; shift ;;
--self-sign) SELF_SIGN="${OPTARG}"; shift ;;
--cert) CERT="${OPTARG}"; shift ;;
--key) KEY="${OPTARG}"; shift ;;
--web) WEB="${OPTARG}"; shift ;;
Expand Down Expand Up @@ -147,6 +151,18 @@ else
die "Could not find vnc.html"
fi

# Create self-signed certificates
if [ -n "${SELF_SIGN}" ]; then
if [ ! -f $(pwd)/self.pem ]; then
Comment thread
blitztide marked this conversation as resolved.
Outdated
echo "Generating Certificate for: ${SELF_SIGN}"
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out self.pem -sha256 -days 3650 -nodes -subj "/C=XX/ST=NoVNC/L=NoVNC/O=NoVNC/OU=NoVNC/CN=${SELF_SIGN}"
fi
CERT=$(pwd)/self.pem
KEY=$(pwd)/key.pem
Comment thread
blitztide marked this conversation as resolved.
echo "Forcing SSL"
SSLONLY="--ssl-only"
Comment thread
blitztide marked this conversation as resolved.
Outdated
fi

# Find self.pem
if [ -n "${CERT}" ]; then
if [ ! -e "${CERT}" ]; then
Expand Down