Video and audio no longer share one iframe-based /screen/<name> page.
Firefox refuses to load iframe content signed by a certificate whose
warning hasn't been accepted at the top level, with no way to click
through inside the iframe (Chrome is more lenient, which is why this
briefly looked fine there). "Open Screen" is now a plain top-level link
straight to noVNC's own URL (new tab, normal Accept-the-Risk applies),
and the "Enable Sound" toggle moved to the main setup page - meant to
be left open in its own tab while playing. Because that page now hosts
a persistent AudioContext/WebSocket, its auto-refresh no longer fires
just because a game is running (only during active installs), since a
full-page refresh would have killed that connection every 3s.
Two real certificate bugs found and fixed along the way:
- CN=NY (a meaningless placeholder) -> CN=localhost + SAN
(DNS:localhost, IP:127.0.0.1). Firefox validates the WebSocket-Secure
connection's cert against the hostname independently of the page
load and rejected the CN mismatch there even after the page-level
warning was accepted.
- Worse: adding -addext without also pinning basicConstraints=CA:FALSE
left the cert defaulting to CA:TRUE - i.e. flagged as a Certificate
Authority, not a server cert. Firefox hard-refuses that with no
override option at all (not a normal clickable warning), which is
why "the warning appears but won't let me proceed" even after the CN
fix. Fixed by explicitly setting basicConstraints=critical,CA:FALSE
plus keyUsage/extendedKeyUsage=serverAuth. Confirmed fixed: Firefox
now shows the same clickable self-signed warning Chrome always did,
and the noVNC connection completes successfully after accepting it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NiNnj78HGx1KWyCCo39HSz
jensandClaude Sonnet 5
eb63f46978