XML Datasource: SSL certificate problem: certificate has expired


(Nic Hubbard) #1

Matrix Version: 5.4.3.1

Our XML Datasource is throwing this error: Cannot connect to server while attempting to access "https://blog.puc.edu/feed" - SSL certificate problem: certificate has expired [CMS0063]

However, when checking our feed URL, https://blog.puc.edu/feed with a SSL checker such as https://www.sslshopper.com/ssl-checker.html#hostname=https://blog.puc.edu/feed it shows that our certificate is fine and not expired.

Why would the XML Datasource continue to report this error which prevents us from using it?


(David Schoen) #2

Matrix is just relying on libcurl from PHP, so a reasonable test is to try curl from the command line on the server. This won’t always go through exactly the same settings as Matrix due to environment variables configuring proxies and potentially statically compiled libcurl in php, but it’s always a good first step.

Locally I get a reasonable response:

$ curl -sv https://blog.puc.edu/feed/ 2>&1 > /dev/null | grep '^< '
< HTTP/2 200
< server: nginx
< date: Tue, 08 Mar 2022 22:32:00 GMT
< content-type: application/rss+xml; charset=UTF-8
< strict-transport-security: max-age=31536000
< vary: Accept-Encoding
< x-nananana: Batcache-Hit
< x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
< host-header: WordPress.com
< vary: Cookie
< last-modified: Tue, 08 Mar 2022 19:59:49 GMT
< etag: "154c92d9452c60e719d3395ce619dfb9"
< link: <https://blog.puc.edu/wp-json/>; rel="https://api.w.org/"
< x-ac: 1.syd _atomic_bur
<

AFAIK certs are not cacheable so my guess would be either the server or a proxy it’s configured to use are resolving something different for blog.puc.edu than what public DNS is resolving. Could be something else, but curl should give some useful information in most situations.


(Nic Hubbard) #3

Yes, blog.puc.edu does point to a Wordpress hosted blog that we have configured to use our subdomain. I am not sure I am seeing anything strange when testing curl, are you seeing something?


(David Schoen) #4

I’m just seeing what I copied above, if you get a 200 of some sort without having to supply the -k flag then it’s working too.


(Nic Hubbard) #5

This looks to be a TLS or openSSL issue on our server.