[PROBLEM] Local display with HTTPS mode enabled

[romain]

Hello, 
If HTTPS mode is enabled, chromium displays a security alert on local display after each reboot. I have to manually bypass the alert to reach coverview mode. 

Picture attached.
   

How can I install the self signed CA certificate into local chromium to get rid off this alert without manual intervention on the touchscreen please ?

Thanks 

---

---

[Tim Curtis]

Try changing http to https in ~/.xinitrc

[romain]

Just took a look at  ~/.xinitrc after enabling https and rebooting, chromium is already set to start in http mode

Couldn't it be the default nginx behaviour to redirect http to https when enabled ?

[romain]

OK, to prevent implicit redirection to https in /etc/nginx/sites-available/moode-https.conf

I replaced 

Code:

server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}

by 

Code:

server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www;
include moode-locations.conf;
}

I think it would be better to have an exception and prevent https redirection for localhost only. This is what I'm trying to do right now but I'm not an nginx expert

[Tim Curtis]

Did the change to https in xinitrc fix the issue?

[romain]

Did the change to https in xinitrc fix the issue?

No because http refirect to https is operated by nginx configuration

[Tim Curtis]

I had to jog my memory on how that HTTPS feature works and yes there is an issue with local display (localhost) not operating over https.

Sure you could bypass the http -> https redirect in the nginx config but that would defeat the purpose of the feature which is to require HTTPS.

There may be an nginx config that allows localhost (127.0.0.1) on http but everything else on https. Maybe someone with expertise in nginx will chime in.

[romain]

I had to jog my memory on how that HTTPS feature works and yes there is an issue with local display (localhost) not operating over https.

Sure you could bypass the http -> https redirect in the nginx config but that would defeat the purpose of the feature which is to require HTTPS.

There may be an nginx config that allows localhost (127.0.0.1) on http but everything else on https. Maybe someone with expertise in nginx will chime in.

Hello Tim,

I came to the same conclusion, allow http for localhost only. I've tried several configurations with conditional redirections without success until now, still searching.

Thanks
Romain

[the_bertrum]

I don't own a local display, but is there a way to emulate this (maybe HDMI to a TV) so I can have a play. It should be possible to generate a localhost certificate and use that in the local Chrome instance to fix this, but I'd need to play a bit with it to work out how.

[TheOldPresbyope]

I don't own a local display, but is there a way to emulate this (maybe HDMI to a TV) so I can have a play.  It should be possible to generate a localhost certificate and use that in the local Chrome instance to fix this, but I'd need to play a bit with it to work out how.

Seems to me an HDMI display would do. Easy enough to try it and see.

I haven't played in the nginx sandbox in a while. Intuitively, it seems like two server blocks would do the job, one listening to port 80 and allowing localhost access only, the other listening to port 443, yada yada yada, but if @romain has been unsuccessful then I'm unlikely to stumble on the answer. 

Have fun.

Regards,
Kent