OpenVidu Pro deployment not recognizing LetsEncrypt SSL certificate

Issues with deployment
1

I have successfully deployed OpenVidu Pro to AWS on CloudFormation using option Letsencrypt.

I have import the wild card SSL certificate to AWS Certificate Manger but server does not recognize the SSL certificate.

Showing ‘Not secure’ when tried to open the url.

When tried to call the url from client code, gives the error “Http failure response for https://www.saimply.com:4443/api/sessions: 0 Unknown Error”

Can you please help in making this through, I’m struggling from last 3-4 days.

Thanks

B Mavi

2

Have you installed latest 2.13 version? In that version, 443 is default port for https.

Why you want to import SSL certificate to AWS Certificate Manager? Lets Encrypt certs are secure, isn’t?

3

Hello Micael, Thank you for redirecting to right direction. It’s working now. I have reinstalled the fresh copy and it started working.
Now the issue is video session is open to public. I have included the security key in configuration but still create the session without asking password. How can I restrict it to open only with password, Here are configuration values:

OpenViduSecret : ***************
WantToDeployDemos: False

Please advise.
Thanks !

4

Hello @BMavi,

OpenVidu Call, the application installed with OpenVidu platform by default, is not protected with a password. We are working in a new version in which you can enable password protection.

Best regards.

5

Hello Micael, Is new version releasing soon with password protection ?

6

In the next 2 or 3 weeks.

In any case, OpenVidu is a platform to develop video conference applications. You have access to OpenVidu Call source code. You can add password protection if you want.

Regards

7

Hi Micael,

I have also noted that the Authentication SECRET does not appear to be checked, so I turn off the servers when not using for testing for now… but I have been too busy to complain. Our IT guys are up in arm about this… I was going to add our certificates and pin it in the client app… glad to hear you are going to fix it!

I assume that “password” refers to Authentication Secret

8

Hello @aurdoc,

I don’t understand your message. Secret is checked on OpenVidu server when received from frontend. Can you explain a bit?

9

Sorry! I probably don’t understand it either…

… but a stranger with access to the url to our openVidu can create a video conference from a browser even if it does not know the our OpenVidu secret… I have not seen being asked anywhere so I assume it is not checked

10

Let me explain how security works on OpenVidu.

Any user can enter to any session if the user knows the OpenVidu SECRET or that SECRET is included in the front end source code. The insecure examples we provide in the website had the SECRET put in JavaScript to allow you try and learn very easily. But the are called “insecure” to note that the SECRET have to be moved to backend.

We are going to publish a new version of OpenVidu Call next week where SECRET is en backend, so you can implement on backend code who is able to enter to the session.

Regards

11

I wish I could take back my comment… obviously I do know how the Auth security works. But Friday evening I was confused and I forgot that a browser cashes the Authentication and does not require them again… when I demo the video conference using our installed server in the data center, the IT team was puzzled on why no authentication was required…as result, I made the wrong impression… but all good now!

I wish I could take back my nonsense question! Thanks for putting up with me!

1 Like