如何为私有网络中的Selenium Grid Hub配置HTTPS协议？

I’ve set up this exact configuration for private network use before, so let’s walk through the process step by step. The core idea is to use Nginx as a secure "front door" that handles HTTPS traffic, then forwards requests to your Selenium Hub (which runs on HTTP internally).

Prerequisites #

First, make sure you have these in place:

• Nginx installed on the same server as your Selenium Hub (or a server that can reach it over your private network)
• Selenium Hub running on its default HTTP port (4444) or a custom port of your choice
• An SSL certificate and private key. For a private network, a self-signed certificate works fine; if you need trusted certs, use an internal CA or Let’s Encrypt (if your network has internet access).

Step 1: Generate a Self-Signed SSL Certificate (If Needed) #

If you don’t have an existing SSL cert, run this command to create one (replace paths as needed):

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/selenium-grid.key -out /etc/ssl/certs/selenium-grid.crt

You’ll be prompted to enter details like your country, organization, and server IP/domain—fill these out appropriately for your private network.

Step 2: Configure Nginx Reverse Proxy #

Create a new Nginx server block configuration file for your Selenium Grid:

sudo nano /etc/nginx/sites-available/selenium-grid

Paste this config, replacing placeholders with your actual server IP and Hub details:

# HTTPS Server Block
server {
    listen 443 ssl;
    server_name X.XX.XX.X; # Replace with your Hub's private IP or domain

    # Paths to your SSL cert and key
    ssl_certificate /etc/ssl/certs/selenium-grid.crt;
    ssl_certificate_key /etc/ssl/private/selenium-grid.key;

    # Secure SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # Proxy requests to Selenium Hub's HTTP endpoint
    location / {
        proxy_pass http://localhost:4444; # Update this if Hub runs on a different server/port
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Timeouts to match Selenium's typical session lengths
        proxy_connect_timeout 30s;
        proxy_send_timeout 300s;
        proxy_read_timeout 300s;
    }
}

# Optional: Redirect HTTP traffic to HTTPS (so users can't accidentally use unencrypted connections)
server {
    listen 80;
    server_name X.XX.XX.X;
    return 301 https://$server_name$request_uri;
}

Enable the Config and Restart Nginx #

1. Create a symlink to enable the site:

sudo ln -s /etc/nginx/sites-available/selenium-grid /etc/nginx/sites-enabled/

2. Test the Nginx config for errors:

sudo nginx -t

3. Restart Nginx to apply changes:

sudo systemctl restart nginx

Step 3: Verify Selenium Hub Accessibility #

Make sure your Selenium Hub is running and accessible via HTTP locally (e.g., http://localhost:4444/grid/console). If it’s on a different server, update the proxy_pass value in the Nginx config to point to that server’s IP and port.

Step 4: Test the HTTPS Setup #

1. Open your browser and navigate to https://X.XX.XX.X:4444/grid/console. If using a self-signed cert, you’ll see a browser warning—this is normal for private networks; you can safely bypass it.
2. Test a Selenium client script using the HTTPS endpoint. Here’s a quick Python example:

from selenium import webdriver
from selenium.webdriver.common.desired_capabilities import DesiredCapabilities

# For self-signed certs, add options to bypass SSL verification (only safe in private networks!)
chrome_options = webdriver.ChromeOptions()
chrome_options.add_argument('--ignore-certificate-errors')

driver = webdriver.Remote(
    command_executor='https://X.XX.XX.X:4444/wd/hub',
    desired_capabilities=DesiredCapabilities.CHROME,
    options=chrome_options
)

driver.get("https://www.example.com")
print(driver.title)
driver.quit()

Troubleshooting Tips #

• Check Nginx error logs if something breaks: sudo tail -f /var/log/nginx/error.log
• Ensure port 443 is open in your server’s firewall (e.g., sudo ufw allow 443/tcp)
• Double-check that your Selenium Hub is running and not blocked by local firewalls
• Verify the SSL cert paths in the Nginx config are correct

内容的提问来源于stack exchange，提问作者djavvadi