Topic-icon SSL certificate problem, verify that the CA cert is OK.

Active Subscriptions:

None
9 years 5 months ago - 9 years 5 months ago #48190 by Gastalver
Hello.

Neither JFBConnect's Remote Error Check, nor Channel preview at SocialDebug.com work, due to a SSL certificate problem.

I have read in other topic that this error arraises when the Certificate Authority signing the certificate it is not included in the machine requesting the page.

The CA it is supossed to be Geotrust. The website's certificate is a SSLRapid one. I bought it because you mention it in FJBConnect documentation. Is it posible that you hold a partnership with TheSSLstore but your server doesn't include the CA required to validate the certificates sold there? Same can be said about JFBConnect Channel preview function, that validates the tags in socialdebug.com.

Any suggestion?
Last edit: 9 years 5 months ago by Gastalver.
The topic has been locked.
Support Specialist
Gastalver,
First, I'm very sorry for the delayed response.

I'm not sure why our servers aren't validating your SSL certificate properly. There have been only a few reports of this over the last few years, and we generally can get our server's root certificate store updated in a few days. It's not a systemic problem with all SSLStore certificates as we use one of their certs for our backend servers and validate many sites that use them. They are simply a broker of certs, and sell from a variety of vendors. It's possible we don't support a specific type of SSL key, yet, but will.

As for the results of that.. right now, Autotune and the Social Debug tool won't be able to scan your https pages. I've gone ahead and manually just checked your page for the issues that the Autotune Error Check tool would look for and didn't find anything.

For Social Debug, similar results that verify that tags have been added, though without some of the extra information we provide, can be found using Facebook's own Open Graph Debug tool:
developers.facebook.com/tools/debug

Again, we'll look into what cert you have and getting our root store updated soon, but wanted to get back to you with the above info now.

Thanks,
Alex
The topic has been locked.
Active Subscriptions:

None
Thanks, Alex. It is a Geotrust RapidSSL certificate. I hope you can tell me something sooner or later.

Regarding the SocialTag issue, I have checked it with Facebook Object debugger. I have some errors that I don't know how to solve. I will open another threat to talk about it.

Thanks again.

Miguel
The topic has been locked.
Support Specialist
Sorry for the delay. We're working with our hosting company to get the certs updated. It's a pain in the rear, in all honesty, and something we're trying to be able streamline easier on our end... it's rare enough though that we haven't taken the time to do it yet though.

As for the Open Graph issues, it doesn't look like you created that thread. In general, I ran a few pages of your site through the linter. For articles, I see some warnings like:

The meta tag on the page was specified with name 'author', which matches a configured property of this object type. It will be ignored unless specified with the meta property attribute instead of the meta name attribute.

Those are perfectly normal and really not anything to worry about. It's not something to be fixed.

The other values I see for your articles look like the title, description and image tags are being properly set and look good in all honesty. Of course, if you're still having issues, just let us know, and we'll gladly help however we can.

Thanks,
Alex
The topic has been locked.
9 years 5 months ago - 9 years 5 months ago #48593 by latino07
Hi:

No intention to hijack, I have this problem with GoDaddy. I believed it was because server update to Centos 6.6, but after re-creating certificates the problem is still there. Same as reported here. Previous GoDaddy certificate (before Centos 6.6) was working fine and JFB 6.2 (I guess) error checking completed sucessfully.

Regards!

Edfel
Last edit: 9 years 5 months ago by latino07.
The topic has been locked.
Support Specialist
Good timing on your post. The SSL root certificates should be updated today, and I've included your site in the testing as well. Hopefully, by the end of the day, both issues will be resolved.

We'll keep you posted.

Thanks,
Alex
The topic has been locked.
Support Specialist
Alright, the root certs were validated on our end. However, there's still issues connecting to your servers for 2 separate, yet similar, reasons. You may need to contact your hosting providers about what could be happening here.

In both cases, I'm running the following command from my Mac terminal prompt, from our server and from another remote location. In all cases, your servers are returning an invalid certificate when being called from the cURL command line utility. The certs do work in the browser, but it seems like there's a mis-configuration problem when an automated connect (non-browser) tries to connect to your sites. The command I'm running (which you can try or pass along to your hosting provider) is:
curl -vk https://www.YOURDOMAIN.com/ | head -n 20

Miguel,
In your case, curl is responding with:

SSL connection using DHE-RSA-AES256-SHA
* Server certificate:
* subject: /C=US/ST=Virginia/L=Herndon/O=Parallels/OU=Parallels Panel/CN=Parallels Panel/[email protected]
* start date: 2014-10-08 15:38:49 GMT
* expire date: 2015-10-08 15:38:49 GMT
* common name: Parallels Panel (does not match 'www.forovivienda.com')
* issuer: /C=US/ST=Virginia/L=Herndon/O=Parallels/OU=Parallels Panel/CN=Parallels Panel/[email protected]

That error is indicating that the Parallels Panel SSL certificate is being returned, and not the actual site SSL cert. This is recreate-able from multiple different computers.

Edfel,
When I run the above for your site, I'm getting the following response *only from our server*:

SSL connection using DHE-RSA-AES256-SHA
* Server certificate:
* subject: /C=US/ST=Puerto Rico/L=San Juan/O=politicaboricua.com/CN=politicaboricua.com/[email protected]
* start date: 2014-10-12 06:32:48 GMT
* expire date: 2015-10-12 06:32:48 GMT
* common name: politicaboricua.com (does not match 'www.prepperspr.com')
* issuer: /C=US/ST=Puerto Rico/L=San Juan/O=politicaboricua.com/CN=politicaboricua.com/[email protected]

In that case, the SSL looks to be for politicaboricua.com and not your site. Is that a site you're affiliated with? This could be a stale certificate that we need to expunge, but if you know any other information, that would help.

Again, with the above info, it may be worth contacting your hosting providers to run the same command to see if they are getting the same error. If so, they may be able to correct things on their end.

Thanks,
Alex
The topic has been locked.
9 years 5 months ago - 9 years 5 months ago #48624 by latino07
Hi:

politicaboricua.com is another website that I have at same server. I use vhosts. Altough politicaboricua.com is offline, I plan to get it online by January 2015 so I dont want to remove from server hostnames and other files. Main site now is prepperspr.com but I have others domains that might be running from same server (politicaboricua.com, bbxyz.com, compledu.com). Altough right now I am focused on prepperspr.com .

Thanks again!

Edfel
Last edit: 9 years 5 months ago by latino07.
The topic has been locked.
Support Specialist
Ahhhh. Thanks for that info, it really helps. It seems like your servers are using SNI, which is a newer (last few years), but not too common (yet) method of using multiple SSL certificates on a single IP address. We're working with our host to upgrade our version of OpenSSL which should support SNI and hopefully get things going for you.

Thanks again for your patience and feedback and, hopefully, this will be resolved within the next 24 hours.

Alex
The topic has been locked.
Hi:

Any update regarding this?

Thanks.
The topic has been locked.