WSS and TLS for WebSockets

Analogy categoryAnalogies

The wss:// Scheme and TLS Handshake

The wss:// scheme is to ws:// what https:// is to http://: the underlying TCP connection is wrapped in a TLS session before any WebSocket-specific bytes are exchanged. The client first performs a standard TLS handshake — negotiating a cipher suite, verifying the server's certificate chain, and establishing session keys — and only after that encrypted channel exists does the browser send the HTTP Upgrade request that begins the WebSocket protocol. In practice this means wss:// almost always runs over port 443, the same port as HTTPS traffic, which also helps it traverse corporate firewalls and proxies that block non-standard ports.

🏏

Cricket analogy: A DRS review has to complete its full technology check (Hot Spot, Snicko, ball-tracking) before the third umpire's final decision is broadcast, just as the full TLS handshake must complete before any WebSocket upgrade bytes are exchanged.

Certificate Management for WebSocket Servers

A wss:// endpoint needs a valid TLS certificate from a trusted certificate authority, just like any HTTPS endpoint; free automated options like Let's Encrypt via certbot or a managed certificate service from your cloud provider (ACM on AWS, for instance) are the standard choice, since self-signed certificates cause browsers to refuse the WebSocket handshake outright with no user-facing bypass option comparable to clicking through an HTTPS warning. Certificates typically expire every 90 days for Let's Encrypt, so automated renewal (a cron job running certbot renew, or a cloud provider's managed rotation) is essential — an expired certificate silently breaks every WebSocket connection attempt until it's rotated.

🏏

Cricket analogy: A player's central contract with the board needs periodic renewal and re-evaluation, and letting it lapse unnoticed means they can't be selected for the next series, just as an expired TLS certificate silently blocks new WebSocket connections until renewed.

Mixed Content and Browser Enforcement

Browsers classify an insecure ws:// connection initiated from a page served over https:// as mixed content and block it outright, with no override available to the end user (unlike some mixed-content image or script cases that show a warning but still load). This is a deliberate security boundary: if the page itself is trusted enough to warrant TLS, any WebSocket it opens must meet the same bar, preventing a scenario where an attacker on the local network intercepts the unencrypted WebSocket channel even though the page load itself was protected.

🏏

Cricket analogy: A stadium that requires all broadcast equipment to be certified secure won't allow one uncertified camera feed to patch into the otherwise secure broadcast truck, just as browsers block an insecure ws:// stream from an otherwise secure https:// page.

TLS Termination Patterns

Most production setups terminate TLS at a load balancer or reverse proxy (an AWS ALB/NLB, or nginx) rather than in the application process itself, then forward plain ws:// traffic to backend instances over a private, trusted network — this centralizes certificate management and offloads the CPU cost of encryption from application servers. Some regulated environments instead require end-to-end TLS, re-encrypting the connection from the load balancer to the backend as well, at the cost of extra CPU and more complex certificate distribution; whichever pattern you choose, remember that load balancers need explicit configuration for long-lived connections (idle timeout settings that default to 60 seconds on many ALBs will silently kill WebSocket connections that go quiet during normal operation).

🏏

Cricket analogy: A stadium's main security checkpoint screens everyone once at the outer gate, and internal staff move freely within the secured perimeter without re-screening at every internal door, mirroring TLS termination at the edge with plain traffic inside a trusted network.

nginx

server {
    listen 443 ssl http2;
    server_name ws.example.com;

    ssl_certificate     /etc/letsencrypt/live/ws.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ws.example.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    location /socket {
        proxy_pass http://backend_ws;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;

        # WebSockets can sit idle between messages (heartbeats aside);
        # raise timeouts so nginx doesn't kill quiet connections.
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

Default idle-timeout settings on load balancers (often 60 seconds on AWS ALB, similarly short on other managed proxies) will silently close WebSocket connections that go quiet, even though the connection is perfectly healthy. Either raise the idle timeout explicitly or implement application-level ping/pong heartbeats frequent enough to keep the connection active.

TLS 1.3 reduces handshake round-trips compared to TLS 1.2, which noticeably speeds up WebSocket connection establishment, especially for mobile clients on high-latency networks — enable it explicitly if your termination layer supports it and disable older, weaker protocol versions like TLS 1.0/1.1.

wss:// wraps the WebSocket handshake and all subsequent frames in a TLS session, exactly like https:// does for HTTP.
The TLS handshake must fully complete before the HTTP Upgrade request that starts the WebSocket protocol is sent.
Certificates need automated renewal (e.g., Let's Encrypt every 90 days); an expired certificate silently breaks new connections.
Browsers block ws:// connections from https:// pages as mixed content, with no user override available.
Most production setups terminate TLS at a load balancer and forward plain traffic over a trusted private network to backends.
Load balancer idle-timeout defaults (often 60 seconds) can silently kill quiet WebSocket connections unless explicitly raised or countered with heartbeats.