Mixed Content/Invalid Certificate errors

Transloadit
1

Archived from the Transloadit support forum. Originally posted on November 28, 2013; details may be outdated, see our docs for current behavior. Original thread

I’m uploading files from a web app served via https. The client uploads the file, then pings the assembly url to determine when the upload is complete before updating it’s display.

The GET requests to find out when the assembly has finished processing were failing with the error “Blocked loading mixed active content” on Firefox because the assembly url was http not https. However, changing the url to be https causes Safari to fail with an “Invalid certificate” error.

Any help would be appreciated.

2

Hi Cayley,
There’s already a feature request ( https://community.transloadit.com/t/external_id/tender-questions-8136 ) to add url_ssl in assembly result so that, when we are in a https page we use the ssl version of url.

As workaround you can convert the result url to https version by changing:
http://tmp.transloadit.com.s3.amazonaws.com/…
to
https://s3.amazonaws.com/tmp.transloadit.com/…

best,
Francisco Azevedo

3

Hey Cayley,

Francisco is right, we have already added this to our todo. We should have this ready by the end of the year hopefully. In the meantime you can use the workaround that Francisco provided.

Thank you, Francisco.

Kind regards,
Tim

Co-Founder Transloadit
@tim_kos

4

I think there is some miscommunication: I was referring to the Assembly status route (section 3.2 in the docs: {assembly_url}?signature={signature}), not the links to the temporary files on AWS.

5

Ah okay, sorry about that.

Which client are you using? Are you using the jQuery plugin?

6

I’m using a custom client based on https://github.com/tim-kos/transloadit_xhr.

I’m also testing on a server using a self-signed cert and I’m not familiar enough with how SSL signing works to know if this would cause the problem (ie. you’re cert’s authorities don’t match mine or something), so any advice there would be appreciated.

The exact error I see in the browser console is “Failed to load resource: The certificate for this server is invalid. You might be connecting to a server that is pretending to be “api2.rahimah.transloadit.com” which could put your confidential information at risk.”

7

+1 I am running into the cert issue even when manually converting the http to https.

This breaks transloadit on Firefox 23+ and Internet Explorer 10+. Any help would be greatly appreciated!

8

Hello,

One note about the (e.g.) rahima waring, our certificate only allows subdomains 1 level deep. Meaning that api2.rahimah.transloadit.com will result in certificate warnings. This is why we have made rahimah.transloadit.com point to api2 by default so you can still have warning-free api2 communication via https://rahimah.transloadit.com.

We’ll review how we can best automate this for our customers so there’s no hackery involved anymore. (e.g. providing an assembly_ssl_url that coexists next to the assembly_url and doing something similar for our tmp files).

Hope this helps,
Kevin

9

Kevin,

Thanks for the tip. I was able to hack it with the following regex:

var url = assemblyUrl
.replace(/http:\/\//, 'https://&#39:wink: .replace(/api2.\w+/, ‘rahimah’);

Like I said, the mixed-content (communicating via http in XHR on a page loaded with https) is blocked in Firefox 23+ and IE10+ so that’s quite a hit.

10

Hi everybody,

Just to to be sure and to close this ticket, we’ve made ssl_url properties available for both api endpoints as tmp files.

Hope this helps,
Kevin

11

Kevin,

Awesome to hear! You guys rock and I love transloadit!

Best,
Ryan