title: Secure WebSocket Connection through nginx 1.10.3 and LetsEncrypt
body: <p>Been ripping hair out because I cannot find out why I cannot connect to my <code>WebSocket</code> server through <code>HTTPS</code>.</p>
  
  <p>So, I have an Express 4 server running a <code>vue</code> app. It uses the <code>ws</code> library from npm to connect to the <code>WebSocket</code> server. The nginx is 1.10.3. I use LetsEncrypt to secure it.</p>
  
  <p>When I go online, I get (in the console):</p>
  
  <blockquote>
    <p>main.js:12 WebSocket connection to 'wss://play.mysite.com:8443/' failed: Error in connection establishment: net::ERR_CONNECTION_CLOSED</p>
  </blockquote>
  
  <p>Line 12:</p>
  
  <blockquote>
    <p>window.ws = new WebSocket(<code>${tls}://${window.location.hostname}:${port}</code>);`</p>
  </blockquote>
  
  <p>That is <code>wss://play.mysite.com:8443</code>. It is indeed on a subdomain.</p>
  
  <p>Here is my <code>nginx</code> block:
  <strong>update:</strong> I got it!</p>
  
  <pre><code>upstream websocket {
      server 127.0.0.1:8443;
  }
  
  server {
      root /var/www/play.mysite.com/dist;
      index index.html;
  
      access_log /var/log/wss-access-ssl.log;
      error_log /var/log/wss-error-ssl.log;
  
      server_name play.mysite.com www.play.mysite.com;
  
      location /ws {
          proxy_pass http://websocket;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
      }
  
      listen [::]:443 ssl ipv6only=on default_server; # managed by Certbot
      listen 443 ssl http2 default_server; # managed by Certbot
      ssl_certificate /etc/letsencrypt/live/play.mysite.com/fullchain.pem; # managed by Certbot
      ssl_certificate_key /etc/letsencrypt/live/play.mysite.com/privkey.pem; # managed by Certbot
      include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
  }
  </code></pre>
  
  <p>As you see, we have the subdomain on <code>https://play.mysite.com</code>. My <code>Express</code> server always listen on port <code>4000</code> and my <code>WebSocket</code> server listens to <code>wss</code> / port <code>8443</code> on production.</p>
  
  <p>When I view the <code>/var/log/wss-error-ssl.log</code>, I get:</p>
  
  <blockquote>
    <p>2018/03/01 04:45:17 [error] 30343#30343: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 68.117.172.118, server: play.mysite.com, request: "GET /static/css/app.67b8cb3fda61e1e2deaa067e29b52040.css HTTP/1.1", upstream: "<a href="http://[::1]:4000/static/css/app.67b8cb3fda61e1e2deaa067e29b52040.css" rel="nofollow noreferrer">http://[::1]:4000/static/css/app.67b8cb3fda61e1e2deaa067e29b52040.css</a>", host: "play.mysite.com", referrer: "<a href="https://play.mysite.com/" rel="nofollow noreferrer">https://play.mysite.com/</a>"</p>
  </blockquote>
  
  <p>So, what exactly am I doing wrong?</p>
  
  <p>The <code>proxy_pass</code> was set right. Listening to port <code>8443</code> for <code>WebSocket</code> on both client/server. What is the meaning? Thank you.</p>
  
  <p>edit: and yes, I know the port <code>8443</code> is running:</p>
  
  <pre><code>root@MySITE:/var/www/play.mysite.com# netstat -l
  Active Internet connections (only servers)
  Proto Recv-Q Send-Q Local Address           Foreign Address         State
  tcp        0      0 *:https                 *:*                     LISTEN
  tcp        0      0 localhost:4000          *:*                     LISTEN
  tcp        0      0 localhost:mysql         *:*                     LISTEN
  tcp        0      0 *:http                  *:*                     LISTEN
  tcp        0      0 *:ssh                   *:*                     LISTEN
  tcp6       0      0 [::]:8443               [::]:*                  LISTEN
  tcp6       0      0 [::]:https              [::]:*                  LISTEN
  tcp6       0      0 [::]:http               [::]:*                  LISTEN
  tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
  udp        0      0 *:bootpc                *:*
  udp        0      0 45.76.1.234.vultr.c:ntp *:*
  udp        0      0 localhost:ntp           *:*
  udp        0      0 *:ntp                   *:*
  udp6       0      0 2001:19f0:5:2b9c:54:ntp [::]:*
  udp6       0      0 fe80::5400:1ff:fe61:ntp [::]:*
  udp6       0      0 localhost:ntp           [::]:*
  udp6       0      0 [::]:ntp                [::]:*
  </code></pre>