wss-guide-unity-transport.md

Websocket Secure Guide (WSS) on Unity Transport

Overview

Do you want to deploy your WebGL game to itch.io or to your personal website but having an error similar to

Connection to server refused

Cannot establish to a secure connection

TLS handshake failed at step 0. Closing connection.

or more...

There are 2 ways to add a secure connection to the game server

• SSL
• Relay (Not Recommended)

Guide Info

• SSL is the most traditional ways but require extra effort to set it up. While Relay is the easiest and most flexible but introduce overhead such as more latency and cost.
• This guide will only cover how to setup SSL for Unity Transport (UTP)
• The guide will not go through one by one and It is recommended to have experience with devOps.

Prerequisites

Requirement	Description	Cost
Domain Name	Namecheap	Paid
Linux Server	Vultr (Alma 9) or equivalent	Paid
WebGL Client Website	Itch.io or equivalent	Free

Technical Infos

Info	Description
Netcode	Netick
Transport	UTP for Netick

In this guide, we're going to use the Netick networking library, however other netcode still behave similarly if they still use UTP.

Guide

1 - Linux Server Setup

In this guide we're going to use Vultr with Alma Linux 9 distro.

• SSH to the machine
• Install Snap

2 - Domain Name Setup

• Create A Record pointing to the linux server

It can be root domain or subdomain
- mygame.com
- play.mygame.com

3 - Create Certificate

• Open the firewall port of HTTP (TCP: 80)
• Open up Certbot Website
  • Make sure the chosen option is Running on Other on Linux (snap)
• When running sudo snap install --classic certbot, sometimes there is this error, don't worry about it and just re-run the command again

error: too early for operation, device not yet seeded or device model not acknowledged

• When it prompts the server common name, put the domain we just input from namecheap (e.g play.mygame.com)

4 - Copy Certificate to Unity

• Print out fullchain.pem and privkey.pem using the cat command

• The first certificate on fullchain.pem will be used for server certificate while, while the second is going to be used for client ca certificate
• Copy each values to the Unity Transport Scriptable Object including the server common name play.mygame.com

WARNING: The best practice is to not put the private key to the client build. Instead we can either:

1. Load it from Disk using File.OpenText API (Most Flexible)
2. Hardcode the Private Key in code and load if Scripting Define Symbols (E.g #if LOAD__PRIVATE_KEY)

HOWEVER We're going to ignore that issue at the moment

5 - Build and Run the Server

• Make sure you have the correct config for the Unity Transport Provider. It should be similar to this
• Build the Server as Linux Executeable
• Send the Executeable to Linux Server
• Run the Server

6 - Itch.io Test

• Build the Client WebGL
• Create a new Project in Itch.io
• Upload the WebGL Build
• Start Netick! Now you should have secure connection both HTTPS and WSS

IMPORTANT: The IP Address on Launching Netick will be irrelevant, because its going to be overriden by the server common name. It's best to put 0.0.0.0

Reference

• https://docs-multiplayer.unity3d.com/transport/current/secure-connection/
• https://mirror-networking.gitbook.io/docs/manual/transports/websockets-transport/ssl

Hey! nice guide. I'm trying to do exactly this, but I'm hosting my game server on Multiplay and using the MAtchmaking system. Could you explain how to do this with a reverse proxy?

I never used a reverse proxy, try to check on the Mirror guide. A Unity team had said It's possible, but if you are using Multiplay, I'm not sure if its possible...