https error

[jmverges]

Hi there,

I'm getting this inside KasmVNC

I have defined as I do in other projects:

services:
web:
external_links:
- "ddev-router:my-site.ddev.site"

Any help?

[rfay]

Hi @jmverges - Most likely you didn't do the required one-time mkcert -install

But please try a plain vanilla DDEV project and see what happens. It doesn't look like your problem has anything to do with playwright.

Quickstarts to try: https://docs.ddev.com/en/stable/users/quickstart/

[jmverges]

well, every other project I run with ddev works well with https, this one fails via the VNC when I do codegen
but not when running the tests in --headed mode

[rfay]

You probably need to manually install the CA in your VNC. Perhaps some permutation of the technique in https://docs.ddev.com/en/stable/users/install/configuring-browsers/

[deviantintegral]

There's two parts to https:

1. https from your browser to kasmvnc. This goes through the normal ddev router, and if you can load a normal ddev project with https this should work as well. Note this has to be over https as the underlying webrtc connection requires https per the spec.
2. https from the browser inside of the kasmvnc session to the app you're working on.

The thing is, the browser in kasmvnc is running in the same container as the web app. It should have the same certificate store as curl and other command line tools.

Does ddev exec curl https://MYPROJECT.ddev.site/ work, or does it throw a certificate error?

[jmverges]

I get the the following, and I tested other projects were and the output is the same.

*   Trying 127.0.0.1:443...
* Connected to my-site.ddev.site (127.0.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: O=mkcert development certificate; OU=jmverges@HappyZombie
*  start date: Dec  9 22:59:42 2025 GMT
*  expire date: Mar  9 22:59:42 2028 GMT
*  issuer: O=mkcert development CA; OU=HAPPYZOMBIE\jmverges@HappyZombie (Juan Manuel Verg�s Solanas); CN=mkcert HAPPYZOMBIE\jmverges@HappyZombie (Juan Manuel Verg�s Solanas)
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* Using Stream ID: 1 (easy handle 0x5f0bf3da49f0)
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET / HTTP/2
> Host: my-site.ddev.site
> user-agent: curl/7.81.0
> accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
< HTTP/2 400
< access-control-allow-origin: *
< content-type: text/html; charset=utf-8
< date: Tue, 09 Dec 2025 23:13:40 GMT
< etag: W/"12-7JEJwpG8g89ii7CR/6hhfN27Q+k"
< x-powered-by: Express
< content-length: 18
<
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection #0 to host my-site.ddev.site left intact
GET query missing.%               `

A bit of background for the other projects, we are schema stiching with graphql diferent ddevs and a few years ago when starting to build this we had to figure out about

services:
  web:
    external_links:
      - "ddev-router:`my-other-project.ddev.site"
      - "ddev-router:`my-second-project.ddev.site"

so I did the same for this playwright one, also I think a key bit is when running the tests they pass, for them to pass they need to be able to access to my-other-project.ddev.site which will be a app and then that app is calling my-second-project.ddev.site so all of them needs to be defined with ddev-router in front

I suppose when running playwright test, kasmvnc is not in the mix, but when doing codegen it is.
But it is curious because I think if I do test --ui and then I go to kasmvnc I can access the https too

[rfay]

In DDEV v1.24.10+, the external_links approach is no longer required. /cc @stasadev

[jmverges]

@rfay does the VNC works for you when accessing a ddev domain via https or you don't have that necessity?

Copilot is telling me
Browser → https://.ddev.site:8444 → ddev-router (SSL termination) → HTTP → KasmVNC
↑
Router expects HTTP here,
but KasmVNC now expects HTTPS

Solution: nginx Reverse Proxy Inside the Web Container Browser → DDEV Router (HTTPS, port 8444) → HTTP → nginx (port 8444 inside container) → HTTPS → KasmVNC (port 8443 inside container)

either that or

Solution: Use a Custom Traefik Configuration (which I tried without luck)

[rfay]

I don't know anything about this add-on, but I'm a maintainer of DDEV.

With DDEV you can use http or https URLs, ddev describe will show thtem to you.

[deviantintegral]

I set up a copy of things and have two suggestions to check:

1. Can you make sure you have ignoreHTTPSErrors: true in your playwright.config.ts (this is noted in the readme and the setup steps at the console).
2. Can you make sure you're running npx playwright from the test/playwright directory? Otherwise it won't pick up your playwright config file which will break a lot of things.

Aside, the reason we do this instead of running mkcert -install is that for some reason mkcert isn't working with Firefox in the container.

[rfay]

Aside, the reason we do this instead of running mkcert -install is that for some reason mkcert isn't working with Firefox in the container.

Firefox in some environments has to have custom CAs manually installed. https://docs.ddev.com/en/stable/users/install/configuring-browsers/

[deviantintegral]

Yeah, I think it's related to playwright shipping an entirely separate Firefox install in the ~/.cache/ directory.