FOP2 SSL WebSocket Failures: The Hidden RSA Certificate Requirement

Published: 2026-02-19
Applies to: FOP2 v2.31.50 and earlier
Environment: Any (Docker, bare metal, VM)

The Problem That Cost Me Hours

You’ve installed FOP2 (Flash Operator Panel 2), configured SSL certificates from Let’s Encrypt, and everything looks fine—until you try to access it. The page loads, but the WebSocket connection fails. Browser console shows cryptic errors about mixed content or WebSocket failures. Sound familiar?

I spent hours troubleshooting this, only to discover a critical undocumented limitation: FOP2 v2.31.50 only supports RSA certificates, not ECDSA (Elliptic Curve) certificates.

Since 2024, Let’s Encrypt has defaulted to issuing ECDSA certificates. They’re more secure and efficient, but FOP2’s underlying SSL library doesn’t understand them. The result? Silent SSL handshake failures that leave you chasing ghosts.

Symptoms You’re Facing

1. Browser Console Errors:

   Mixed Content: The page was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint
   WebSocket connection failed
   wss://your-server:4445/ request blocked

2. OpenSSL Shows No Certificate:

   openssl s_client -connect your-server:4445
   # Returns:
   # no peer certificate available
   # SSL handshake has read 0 bytes

3. FOP2 Appears to Start: Process is running, but SSL isn’t actually working

4. Authorization Errors: authorized=0 in browser console even with correct credentials

Root Cause

FOP2 Version Tested: 2.31.50

The Fix: Force RSA Certificate

Step 1: Check Your Current Certificate Type

openssl x509 -in /etc/letsencrypt/live/your-domain/fullchain.pem -noout -text | grep "Public-Key"

• RSA: Shows Public-Key: (2048 bit) or (4096 bit) ← Working
• ECDSA: Shows Public-Key: (256 bit) ← Problem!

Step 2: Reissue with RSA

sudo certbot --apache \
  --key-type rsa \
  --rsa-key-size 4096 \
  --cert-name your-domain \
  -d your-domain \
  --email your-email@domain.com \
  --agree-tos \
  --redirect \
  -n

Docker users:

docker exec -it <container_id> certbot --apache \
  --key-type rsa \
  --rsa-key-size 4096 \
  --cert-name your-domain \
  -d your-domain \
  --email your-email@domain.com \
  --agree-tos \
  --redirect \
  -n

Step 3: Update FOP2 Configuration

Edit /usr/local/fop2/fop2.cfg:

ssl=yes
ssl_certificate_file=/etc/letsencrypt/live/your-domain/fullchain.pem
ssl_certificate_key_file=/etc/letsencrypt/live/your-domain/privkey.pem

Step 4: Restart FOP2

# Stop any running instance
pkill -f fop2_server

# Start fresh
/usr/local/fop2/fop2_server -d

# Or in foreground to see errors
/usr/local/fop2/fop2_server -f

Step 5: Verify SSL Works

openssl s_client -connect your-domain:4445

You should now see certificate details instead of “no peer certificate available.”

Complete Troubleshooting Checklist

1. Is FOP2 Actually Running?

ps aux | grep fop2
netstat -tlnp | grep 4445

2. Test SSL/TLS Layer

# Should show certificate chain
openssl s_client -connect your-domain:4445

# Check certificate type
openssl x509 -in /path/to/cert.pem -noout -text | grep "Public Key Algorithm"

3. Test WebSocket in Browser

Open FOP2 page → F12 Console → paste:

const ws = new WebSocket('wss://your-domain:4445');
ws.onopen = () => console.log('✅ Connected');
ws.onerror = (e) => console.log('❌ Error:', e);
ws.onclose = (e) => console.log('🔒 Closed:', e.code, e.reason);

4. Verify Certificate Files Exist and Are Readable

ls -la /etc/letsencrypt/live/your-domain/
namei -l /etc/letsencrypt/live/your-domain/fullchain.pem

5. Check FOP2 Configuration Syntax

/usr/local/fop2/fop2_server -t

6. Review FOP2 Logs

tail -f /usr/local/fop2/log/fop2.log

Quick Reference: Certificate Types

┌─────────────────────────────────────────────────────────────┐
│  RSA Certificate (GOOD)                                     │
│  Public Key Algorithm: rsaEncryption                        │
│  Public-Key: (4096 bit)                                     │
│  ✅ Works with FOP2                                         │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  ECDSA Certificate (BAD for FOP2)                           │
│  Public Key Algorithm: id-ecPublicKey                       │
│  Public-Key: (256 bit)                                      │
│  ❌ Not supported in FOP2 v2.31.50                          │
└─────────────────────────────────────────────────────────────┘

Additional Configuration Notes

FOP2 Users File

Don’t forget to create /usr/local/fop2/fop2-users.cfg:

[admin]
secret=your_secure_password
extension=100
context=from-internal
permit=0.0.0.0/0

Manager Configuration

Ensure /etc/asterisk/manager.conf has the FOP2 user:

[fop2]
secret=your_password
deny=0.0.0.0/0.0.0.0
permit=127.0.0.1/255.255.255.255
read = all
write = all

When Will This Be Fixed?

As of FOP2 v2.31.50, ECDSA support is not available. The software may evolve in future versions, but for now, RSA certificates are required for SSL/WSS functionality.

Recommendation: Always verify certificate type when troubleshooting FOP2 SSL issues—it will save you hours of frustration.

Summary

Environment: Tested on FreePBX 17 + Asterisk 22 in Docker, but applies to any FOP2 installation.

Keywords: FOP2, SSL, WebSocket, RSA, ECDSA, Let’s Encrypt, FreePBX, Asterisk, certificate, wss, troubleshooting

Have you encountered this issue? Did this solution work for you? Let me know in the comments.