x

Search in
Sort by:

Question Status:

Search help

  • Simple searches use one or more words. Separate the words with spaces (cat dog) to search cat,dog or both. Separate the words with plus signs (cat +dog) to search for items that may contain cat but must contain dog.
  • You can further refine your search on the search results page, where you can search by keywords, author, topic. These can be combined with each other. Examples
    • cat dog --matches anything with cat,dog or both
    • cat +dog --searches for cat +dog where dog is a mandatory term
    • cat -dog -- searches for cat excluding any result containing dog
    • [cats] —will restrict your search to results with topic named "cats"
    • [cats] [dogs] —will restrict your search to results with both topics, "cats", and "dogs"

Does UE4 support HTTPS?

I'm prototyping a game in Unity 5 and UE4 to see which one fits the game best, and so far I've had no luck with getting SSL certs setup with Unity. I see UE4 uses libcurl, so does the FHttpModule support HTTPS and verifying certificates? Also, are there any limitations, E.g. hash length/algorithms? I know Unity has limitations like this, that's why I ask.

Product Version: Not Selected
Tags:
more ▼

asked Aug 04 '15 at 02:02 AM in C++ Programming

avatar image

kkirkfield
21 1 3 6

(comments are locked)
10|2000 characters needed characters left

3 answers: sort voted first

The HTTP code does support SSL and verifies the certificates. We use it to communicate with various online RESTful services.

more ▼

answered Aug 04 '15 at 07:26 PM

avatar image

joeGraf STAFF
1.5k 35 12 67

avatar image ambientenergy Jan 31 '17 at 01:15 PM

This doesn't appear to be accurate with local testing on my windows 10 workstation using unreal 4.14

Tracing it down, looks like on windows in CurlHttpManager.cpp [484] that the CertBundlePath is null. As a result bVerifyPeer is set to false and by default UE4 doesn't check anything other than the hostname for a certificate.

Is it just me or is security off by default? Haven't been able to find documentation referencing this issue.

Info Log :

LogInfo:Display: ExecuteHttpStaticRecv(40): Got http response [200] : https://expired.badssl.com/

LogInfo:Display: ExecuteHttpStaticRecv(40): Got http response [200] : https://sha256.badssl.com/

LogInfo:Display: ExecuteHttpStaticRecv(40): Got http response [200] : https://untrusted-root.badssl.com/

LogInfo:Display: ExecuteHttpStaticRecv(40): Got http response [200] : https://self-signed.badssl.com/

LogInfo:Display: ExecuteHttpStaticRecv(40): Got http response [200] : https://revoked.badssl.com/

LogInfo:Display: ExecuteHttpStaticRecv(40): Got http response [200] : https://incomplete-chain.badssl.com/

avatar image ambientenergy Jan 31 '17 at 01:20 PM

Tracing down on github, I believe this change is responsible?

https://github.com/EpicGames/UnrealEngine/blame/4.14.1-release/Engine/Source/Runtime/Online/HTTP/Private/Curl/CurlHttpManager.cpp#L486

Change 2958724 on 2016/04/28 by #########

 moved setting bVerifyPeer flag AFTER CertBundlePath has been set...

 otherwise, libCurl is going to try to verify the SSL session - but without a cert file, it makes no sense to try and verify the session

 - we could (and probably should) make this an error condition - but the constructor has the bVerifyPeer set to true -- which would mean that all games will need to have a cert file and/or know to set bVerifyPeer to false...

 - and so far, only linux and android seem to have code in place to make use of the cert files...

 #jira UE-29950 - Orion deticated server MCP authentication fails when using CURL
 #lockdown ##########
(comments are locked)
10|2000 characters needed characters left

Any word on this? I'm not able to download a file from an HTTPS url either.

more ▼

answered Oct 04 '18 at 10:13 AM

avatar image

Randy Croucher1
6 1 2

(comments are locked)
10|2000 characters needed characters left
more ▼

answered Jan 11 '19 at 02:02 AM

avatar image

Hello LiamLewis
1

(comments are locked)
10|2000 characters needed characters left
Your answer
toggle preview:

Up to 5 attachments (including images) can be used with a maximum of 5.2 MB each and 5.2 MB total.

Follow this question

Once you sign in you will be able to subscribe for any updates here

Answers to this question