Hi @andypiper .
I'm a developer working with @lolibrarian on fixing this.
Yesterday we switched a to using http, not https for our social image meta tags (our sys-eng team is working on updating our TLS stack). It's certainly helped! So a hearty Thank you to both of you.
Using the validator (and twitter) we see many but not all cards preview successfully.
I'm hoping that once crawler's cache clears - we'll see more and more pages preview successfully.
Finally here's some (unsolicited) feedback that could help us and probably others in the future.
Does the crawler that backs the validator tool observe the 7-day cache?
It may be helpful to say so on the validator site.
It would also be helpful to add verbose logging on the validator about why the default image was put up.
In our case, because of our outdated TLS stack.
I'm curious why the crawler on your localhost was able to hit our shoddy https URL but the production crawler couldn't.
Finally - thank you both again!