Email link to watched threads not working

[TheOldHokie]

Chrome recently started having problems with the links in emailed notifications for watched threads. It does not like the cert provided by the referenced server:

NET::ERR_CERT_COMMON_NAME_INVALID

I thought it might be transient but it has persisted for at least a week. Here is an example URL

Snow plowing

Snowplowing my gravel driveway with the 8n and a back blade, how to I prevent the blade from wanting to dig in too deep? I now have a dirt driveway and a gravel yard.☹️

url8469.yesterdaystractors.com

 

[cpratt]

Email notifications are working, for example, I got a notification to respond to your thread, and if an email notification weren't working, you would just not get a notification, there would be no error except in system logs when delivery failed. So you must be set up for a different type of notification. Are you using RSS notifications?

 

[TheOldHokie]

Email notifications are working, for example, I got a notification to respond to your thread, and if an email notification weren't working, you would just not get a notification, there would be no error except in system logs when delivery failed. So you must be set up for a different type of notification. Are you using RSS notifications?

I am getting the email notification. When I click on the embedded link to the thread Chrome barfs on the certificate provided by the server. Looks like a common name mismatch

 

[cpratt]

Oh, I get it, using the link in the email. I'd never tried that but just did. It works on Safari but I'll update my chrome and try it there.

 

[TheOldHokie]

Oh, I get it, using the link in the email. I'd never tried that but just did. It works on Safari but I'll update my chrome and try it there.

I will test on my desktop to see of its something related to Android. I will also dump the full certificate to see the details in it. I had to manually navigate to this thread to post this reply. Other sites are working fine so it appears to be YT specific. I have zero problem doing that.

Thanks for your help,

Dan

 

[cpratt]

I will test on my desktop to see of its something related to Android. I will also dump the full certificate to see the details in it. I had to manually navigate to this thread to post this reply. Other sites are working fine so it appears to be YT specific. I have zero problem doing that.

Thanks for your help,

Dan

I tried it on a current firefox and that was fine too. Tried both Chrome and Brave (a more secure version of Chrome) and initially got a timeout screen that flashed but then the page loaded normally. This is on my relatively slow satellite connection. Could be your android connection is having trouble with that initial negotiation for the secure cert. Would be interesting to know what firefox would do with the same link. If you have FF, just copy the link as shown in the email and paste it in to see what the results are.

In the meantime, I'll take it to our contractor who handles our cloudflare connection. It might be that we do need a network setting changed for slower connections, at least as far as that email link goes.

 

[TheOldHokie]

Oh, I get it, using the link in the email. I'd never tried that but just did. It works on Safari but I'll update my chrome and try it there.

Well that was interesting.

Chrome on my Windows desktop has no problems with the links. I got here with the desktop using the exact same emailed link the phone barfs on. Looks like this is something on my end. Its definitely at the SSL handshake level (or should I say that's what the error message says ) and both phone and desktop are using my local WIFI network

Dan

 

[cpratt]

I'm not sure it's on your end so much as there is some combination there which is showing up a time out problem. Since I received the timeout message on Chrome, and I'm on a non-typical circuit, Chrome and Cloudflare or that email provider (not sure which), may be having a negotiation failure under the right (wrong) circumstances. I've forwarded your finding to the network support folks along with my comment.

 

[TheOldHokie]

I'm not sure it's on your end so much as there is some combination there which is showing up a time out problem. Since I received the timeout message on Chrome, and I'm on a non-typical circuit, Chrome and Cloudflare or that email provider (not sure which), may be having a negotiation failure under the right (wrong) circumstances. I've forwarded your finding to the network support folks along with my comment.

I share my internet connection with two sons that work from home and use some very network intensive applications - lots of timeouts and slow ppage loads when they are active. But those are fl;agged as timeouts (occasionaly DNS errors) not cert validation errors. I tried this in the early AM this morning when the network was not busy and still got the error. Its not intermittent like a typical timeout problem - solid as a rock.

I will keep on poking from my end, Thanks for the help from your end.

Dan

 

[cpratt]

I share my internet connection with two sons that work from home and use some very network intensive applications - lots of timeouts and slow ppage loads when they are active. But those are fl;agged as timeouts (occasionaly DNS errors) not cert validation errors. I tried this in the early AM this morning when the network was not busy and still got the error. Its not intermittent like a typical timeout problem - solid as a rock.

I will keep on poking from my end, Thanks for the help from your end.

Dan

I have to claim ignorance on how the link is working. It is using a 3rd party email service that allows the mail to be delivered and then has hidden links (in other words that url isn't actually a real dns name for YT, but is generated on the fly). I'm not sure if it's cloudflare or the email service that generates it (most likely cloudflare since they handle our DNS now). My knowledge here is fuzzy enough that I have to defer to the experts in this area. url8469 is not a YT DNS entry, but it is used in all email comms to point back to the actual YT server and something dynamic that's outside my experience. I'll see what we find out and report back.

 

[TheOldHokie]

More dataoints:

i tried the link from home shortly after my last post and it worked. It then failed on ten additiomal tries befote I gave up.

i am currently sitting in the waitimg room at the doctors office using my cellular connection. The link is solid as a rock.

Dont you just love networking

Dan

 

[cpratt]

More dataoints:

i tried the link from home shortly after my last post and it worked. It then failed on ten additiomal tries befote I gave up.

i am currently sitting in the waitimg room at the doctors office using my cellular connection. The link is solid as a rock.

Dont you just love networking

Dan

Wow, really does sound like my network issues here. Living in a cell dead zone means everything works fine when I'm not at home. But at home, the only cell I get at my house is bounce off my metal barn (it sits up the hill and beyond the verizon dead zone line), so voice works, but anything internet, sometimes works a little and often not at all. Then I have Satellite for my main internet which works mostly okay until I fire up the work VPN, then I have problems. No, don't love networking . People in cities don't appreciate how good they have it from a net standpoint!

 

[TheOldHokie]

I have to claim ignorance on how the link is working. It is using a 3rd party email service that allows the mail to be delivered and then has hidden links (in other words that url isn't actually a real dns name for YT, but is generated on the fly). I'm not sure if it's cloudflare or the email service that generates it (most likely cloudflare since they handle our DNS now). My knowledge here is fuzzy enough that I have to defer to the experts in this area. url8469 is not a YT DNS entry, but it is used in all email comms to point back to the actual YT server and something dynamic that's outside my experience. I'll see what we find out and report back.

Arrrgghhh. Still at the Doc's and now its not working usung cellular.

Its been a decade since I last looked at the details of the SSL handshake and how common name is managed by distributed web servers hosting multiple sites but this is starting to look to me like a server side issue.

Dan

 

[cpratt]

Arrrgghhh. Still at the Doc's and now its not working usung cellular.

Its been a decade since I last looked at the details of the SSL handshake and how common name is managed by distributed web servers hosting multiple sites but this is starting to look to me like a server side issue.

Dan

Well, not server side in the traditional sense because the server has no public certificate when you are set up with a proxy like Cloudflare, our server has some sort of private SSL between us and the network provider. They do all the SSL negotiation with the internet side clients. But yes, "someone's" server indeed. That's why it has to go to our network guy. No word back yet, but it's early out here to expect any.

 

[TheOldHokie]

Well, not server side in the traditional sense because the server has no public certificate when you are set up with a proxy like Cloudflare, our server has some sort of private SSL between us and the network provider. They do all the SSL negotiation with the internet side clients. But yes, "someone's" server indeed. That's why it has to go to our network guy. No word back yet, but it's early out here to expe

From my wnd this appears to be an issue with the SSL cert your proxy uses on your behalf. IIRC correctly the common name in it is "yesterdaystractors.com"

Dan

 

[DoubleO7]

All nine links contained in my email notification are working.
Via Edge on Windows PC.

 

[cpratt]

From my wnd this appears to be an issue with the SSL cert your proxy uses on your behalf. IIRC correctly the common name in it is "yesterdaystractors.com"

Dan

Yes, but since it's served from our provider, I don't have direct access to it like I did when our server handled it's own SSL connection.

 

[cpratt]

All nine links contained in my email notification are working.
Via Edge on Windows PC.

View attachment 60763

Same here, working on all browsers on all connections I have available. What's odd is that it's not working for him on two different devices with different network connections. You and I are on opposite ends of CONUS, he's east coast and actually in the same state my satellite connection comes through (though of course not the same trunk of the net most probably). A real head-scratcher.

 

[TheOldHokie]

Head scratcher indeed. It appears I am the only one experiencing the problem which makes me sispicious of my end. I considered the possibiity i have some malware issue but if so it is uncharacteristicly selective. YT is the only thing affected.

Dan

 

[cpratt]

Doubt it's your end per se. More like an interaction of something you use and cloudflare. How new (updated) are your chrome versions. There could be a missing component in ssl negotiation related just to modern dynamic DNS stuff and proxying. Again, I'm talking through my hat on this because that industry/technology has left me in the dust.