I have included two videostreams in my openhab overview page. They are implemented on oh-image-cards and the items displayed are MPEG URLs. They can be accessed and displayed from the browser.
This works perfect in the administration page and in the http-mode.
When I access the overview page with http://192.168.2.182:8080/overview the video is displayed and actualised.
When I access the overview page in the https mode it doesen’t work
When I access the overview page with https://192.168.2.182:8443/overview the video stream is not displayed
Browsers typically do not allow one web page to display both HTTPS and HTTP content at the same time. It’s a pretty big security hole. I don’t know for sure that’s the problem, but it’s the first thing I would check. There might be something in the console logs of the browser which shows an error with more information.
I tested this. I had only one browser accessing openhab. I tried it with Firefox and chrome and tried it with http on the one side and https on the other side.
But also when I had only one https browser window accessing openhab, it did not display the videostreams in the https mode. But it worked when I had only one accessing window in the http mode
Right. When you bring up MainUI in HTTPS, the MPEG streams are using HTTP. The browser won’t show the HTTP content.
When you bring up MainUI in HTTP, both MainUI and the MPEG streams are using HTTP so there’s no problem.
You don’t show the URL, but if your MPEG streams use HTTP, it’s not going to work when you bring MainUI up using HTTPS. You cannot mix the two on the same page.
If doorbird doesn’t support HTTPS you don’t, at least not easily. You’ll have to use HTTP or set up a reverse proxy to convert from HTTP to HTTPS for the video streams. You might be able to use the IP Camera binding, I don’t know.
Except in certain specific circumstances, there’s no reason to require HTTPS on your own home LAN. If someone is able to sniff your unencrypted traffic on your LAN, you have bigger problems than protecting openHAB. They are already on your network and can see all the traffic, and are likely on one of your machines too.
Thanks. I don’t use https due to security reason. I don’t need the security aspect in my local network. But I have created an oh-sipclient-card to call my doorbird and receive calls from the doorbird by SIP. I have set up an asterisk system which provides a websocket for the oh-sipclient-card. And that works only with https (wss://asterisk-id:8089/asterisk/ws). That is my reason to go for https. The oh-sipclient works pretty well (in https mode only !). I can call the doorbird and receive calls via SIP. The oh-sipclient doesn’t register at asterisk at all in http mode. But I would like to see the video during the call. So I need to bring the oh-sipclient and the videostream in one widget. I have already thought about some http-to-https converter. Does ffmpeg such a job ?
No. That would be like using a potato peeler to pump up a bike tire. They are completely unrelated.
First I’d verify that doorbird definitely does not provide an https URL.
If not, then see if you can use the IP Camera binding. This binding will connect to the HTTP MJPEG stream but it provides the snapshots and video locally to OH so it will work not just using HTTPS but also when using myopenhab.org.
If that doesn’t work, you’ll need something like ngnx, Apache, HAProxy, etc. to act as a go-between openHAB and the doorbird so that openHAB. This is very advanced and will take a lot of trial and error and research to get right I suspect.
I just briefly checked and it seems that Doorbird only offers RTSP and HTTP.
Instead of trying to add some proxy somewhere simply to encapsulate HTTP traffic in HTTPS, it might be an easier path to simply configure the browser to allow HTTP content in HTTPS pages, or simply use HTTP only. For safety, you should only do this on devices that never leave your home network, though…
With HTTPS, there’s also the extra hurdle that encryption requires a certificate, which if it’s a self-signed one will not be trusted by any browser and will trigger privacy warnings until you exceptionally accept them, and I won’t even get into the discussion on getting proper certificates signed by a trusted certificate authority…
Embedding HTTP contents in a HTTPS page is called “mixed content”, and all mainstream browsers have been treating this either with warnings or refusing to display them, considering them a security risk. The unencrypted part can be subject to a “man in the middle” (MITM) attack, which could bring undesired contents into a secure page for nefarious purposes.
In a sample scenario, you use what seems to be a public WiFi network to access your e-banking portal through a secure connection, but their site also embeds an unencrypted iframe. The WiFi network is actually fake and is trying to steal data. It can’t do anything about the HTTPS connection but pass the encrypted data from the actual server through, but it does see the unencrypted HTTP request and, instead of passing to the browser the actual data from the server, it supplies a piece of javascript code which reads contents from the page on your screen. That’s how the MITM can gain access to the information which otherwise would have been encrypted. So browsers reject this as a safety measure.
Allowing mixed content or preventing warnings about mixed content is also not a very simple and obvious setting.
In Firefox, you need to get to the advanced settings by typing into the address bar:
about:config
You’ll see a long list of settings. Use the search function to look for:
security.mixed_content.block_active_content
Double-click on it to change it to False. This will no longer block mixed content, and will allow HTTP content embedded into HTTPS pages. Close and restart Firefox for the setting to become active.
For Chrome, this isn’t even a setting in Chrome itself, but a command line parameter for starting Chrome:
IP Camera binding supports RTSP. Using that will allow it to work, HTTP, HTTPS and when you bring up MainUI remotely through myopenhab.org. Enabling mixed content on the browser won’t support that last part.
Which is already the case with MainUI running under HTTPS.
Note, this cannot be disabled for just one website. Any website brought up by this browser will allow mixed content after that setting is changed which is probably not the best idea.
I really do think, given the options, the IP Camera binding is the most secure and flexible way to go given doorbird supports RTSP.
I tried also rtsp access to the doorbird. It works perfectly in VLC and in the http mode.
In the overview page open in https mode, also rtsp content is not displayed. I have mixed content enabled and it doesn’t help tzo solve the problem. I have mixed content disabled and also the stream is not shown in https mode
I had a look at the IP Camera Binding. But there is nothing to configure. And in the thing configuration I don’t see any options which would help me. So I don’t understand what I shall do with the binding. I access the doorbird with rtsp and that works perfectly in http mode. I don’t see other options in the binding. I can access the doorbird by rtsp.
rtsp://ghecrnxxxx:xxxx@192.168.2.131/mpeg/media.amp works perfectly in openhab , http mode.
I’m sorry but I don’t understand what I shall do with the rtsp URL in openhab. I don’t want to ignore hints or annoy you.
Doesn’t that mean, that the http content should be displayed?
Could there be a certificate problem ? I do not have installed any certificate on the openhab server. It still has the keystore file from the installation. I have installed a certificate locally in the browser to access asterisk. But now certificate on the openhab server
Might steal it for future use…