how to work around this? about camo

[atmos]

We recently added the behavior to 404 on images where SSL hosts can't be verified. My guess is it might be the version of curl that's linked to on heroku.

[dominictarr]

so what does this mean? Is my ssl certificate not good enough?
Is there anything I can do to reproduce this locally?

[atmos]

Yup. Create a url in the tests that passes and see if you can get the tests running locally.

We could hit up heroku about their certs but I'm at a loss. This is the first time anyone has come back to us with their cert not validating.

[hundredwatt]

We ran into this recently. The OS that Heroku uses for dynos doesn't have up to date SSL certs.

To reproduce, launch anew Heroku app or go to an existing one, the run:

$ heroku run bash
> curl https://www.yourwebsite.com

If you get an SSL error, you'll know Heroku doesn't have your CA's certificates

On Wednesday, January 29, 2014 at 7:54 PM, Dominic Tarr wrote:

so what does this mean? Is my ssl certificate not good enough?
Is there anything I can do to reproduce this locally?

—
Reply to this email directly or view it on GitHub (#37 (comment)).

[dominictarr]

I see the same thing when I use curl on my laptop,
although the browser does not complain.

Aha, I think I found the solution here:
http://www.benjiegillam.com/2012/06/node-dot-js-ssl-certificate-chain/

the node.js https docs are not very informative, currently...

We've also just run into exactly this issue on https://ci.testling.com.

https://github.com/substack/tape#tape

Here are some broken images:
https://github-camo.global.ssl.fastly.net/b644b2528fe8c51c6c6add3b592334b12e4f64d4/68747470733a2f2f63692e746573746c696e672e636f6d2f737562737461636b2f746170652e706e67 on https://github.com/substack/tape#tape
https://github-camo.global.ssl.fastly.net/1bbdd4aa0998e49cf40637e550d0591a67dc7b54/687474703a2f2f63692e746573746c696e672e636f6d2f737562737461636b2f617374772e706e67 on https://github.com/substack/astw#astw

Can camo at least be patched to give a more informative message than "not found" when the certificate check fails? This ate up a whole day trying to chase down.

[atmos]

We should probably include the message like you suggest. It's been a nightmare to support as well.

[pkrumins]

I can't get it working currently for Testling. It was working before our cert expired, I installed a new one and now it's failing.

[atmos]

We may need to bust the cache. Can you email [email protected] with the repo in question and the output of curl -vv on the github image and on the raw image that's being proxied?

[pkrumins]

It's working now. The issue was with how you pass the CA Bundle to node. We passed it as a string to https's ca option, but it had to be passed as an array of strings. Some weird Comodo Ssl certificate thing.

[atmos]

I'm closing this out unless people are still having problems. It's been 18+ months.