Connection refused when fetching a summary card

[csaltos]

@PiciScan a couple of months ago a similar problem happened like this but with LinkedIn: everything was OK and suddenly our “poor” GoDaddy certificate was not recognized anymore by LinkedIn. Of course we’ve tried to contact LinkedIn regarding this issue and for them to update their CA certification base correctly but no answer. We were about to buy a new more “fancy” and more expensive SSL certificate when the problem was magically fixed at one of the LinkedIn own releases when they update correctly their CA certificates.

Things we’ve learned:

• The cheap SSL certificates are cheap for a reason and that is because they have mostly unknown intermediate CA validations and thus most of the upgrades of third parties will take time for them to recognize your “poor” SSL certificates (if important to you and you can afford it, of course try to purchase more fancy SSL certificates with a more solid and recognized CA validation)
• For the mega organizations to listen to the small clients is very difficult, but here we are, let’s hope they listen to us one day !!
• The goal of the mega organizations is to ensure a correct and secure connection and use, so if you follow good security practices you are closer to get a good relationship with Twitter, LinkedIn and others (for instance, try to get a good rating using tools like ssllabs.com)
• And PATIENCE !! … lots of PATIENCE !!

[PiciScan]

@juanjodlt Any progress? I just can’t understand why all Twitter Cards were working fine, and then, though nothing had changed on my website, they suddenly didn’t. It is VERY frustrating.

[PiciScan]

Just a thought … has the post by @rchoi on Automatic Cards Whitelisting got anything to do with this?

[juanjodlt]

Hi @PiciScan, thanks for pointing that post to us. Indeed, now our summary cards are working. The card previewer/validator is not working yet, I guess Twitter Devs are making some changes to integrate the new Automatics Cards Whitelisting thing with it.

@OMGUrOnline @sarahzj @espanabreaks @PiciScan: Does you cards are working now?

[OMGUrOnline]

My Player Cards still do not work when using a https link, but work fine when using a http link…

[espanabreaks]

Still no joy unfortunately

[OMGUrOnline]

Hey PiciScan,

I checked that out and it seems the issue everyone is having is with Player Cards, which still require validation and whitelisting by Twitter. They are the only cards that aren’t supposed to be affected by the automatic whitelisting.

Thanks, though… it was another lead to follow.

Greg

[jbulava]

I have passed this issue along to the Cards engineering team and will respond here with updates. This is being tracked internally as PREL-12939.

[juanjodlt]

Thanks @jbulava. I’ve tested today with this link: https://www.talenteca.com/empleo/mexico/cuautitlan-izcalli-edo-de-mex-/auxiliar-de-almacen/5522c5305801005601543fcd and the large-summary-card is not being showed.

[jbulava]

As engineering continues to investigate on our side, I’ve been asked to inquire about the hosting service providers used by those affected. Could you please respond here with that information?

[OMGUrOnline]

jbulava,

I am using certifiedhosting.com for my server hosting.

Greg

[OMGUrOnline]

it’s been officially over a month since my player cards stopped working…

[juanjodlt]

@jbulava our site is hosted in AWS-EC2

[espanabreaks]

We are using Vidahost Cloud and have sitewide SSL enabled. We have a couple of sites on it using cards, both configured identically. bathmums.co.uk continues to work fine, espanabreaks.com cards worked initially then broke. The latter has a fairly new certificate (<2 months old), the former was first issued in 2013 and renewed about 6 months ago.

[OvercastFM]

I’m facing the same issue — my cards (e.g. http://overca.st/CdT4UF_0) stopped working at the same time and produce the “connection refused” error as well. Nothing changed on my end that would break this, as far as I know. The SSL certificate has remained constant.

I’m hosted at Linode, but I bet that’s not the issue. My SSL certificate is still signed with a SHA-1 signature, if that helps — ultra-strict implementations are beginning to show warnings about those. (I can’t upgrade without breaking some old SSL-pinned clients, so I’m waiting as long as I can.)

[DenisLaliberte]

We encounter the same ssl issue. We bypass the issue by redirecting the twitter user agent to the http site and all other requests to https.

Now we can use the validator with the http url, twitter can fetch the card metadata, and all regular users are redirected to https.

This is only a temporary fix but it’s working for now.

Here some configuration example for Apache :

RewriteEngine On
RewriteCond %{HTTPS} =on
RewriteCond %{HTTP_USER_AGENT} ^Twitterbot/(.)$
RewriteRule ^/?(.)$ http://%{HTTP_HOST}/$1 [R=301,L]

[OvercastFM]

I’ve upgraded my certificate to SHA-256 and removed an HTTP-to-HTTPS short-domain-to-long-domain redirect. The SSL implementation gets an “A” from the Qualys SSL test (although it did before, too). New link example: https://overcast.fm/+DCGWw7c

The problem persists.

[andydust]

Upgrading OpenSSL fixed this for us.

[OvercastFM]

This has been fixed for my site sometime in the last 48 hours or so. Fixed for everyone, or just me?

[450GSM]

It seems to be fixed for our site, too!