YES! About a week ago, my virus protection starting saying something like "the certificate of this web site is no longer valid" or something along those lines. It was specifically talking about the pinside site. Since then pictures haven't been showing up.

Are you enjoying this one?

ted.jpg

Those of you having problems, if you're computer savy, see what the IP address of img-f.pinside.com is for you. (Yes, it can vary, based on where in the world you are, and what ISP you're on).

Some possible ways to do it, in a command prompt or dos box or terminal window etc:

host img-f.pinside.com
ping -c img-c.pinside.com
dig img-f.pinside.com a

It might be also helpful to capture the details of the certificate warning, with as much detail as possible shown. Keep in mind that not everyone may be hitting the same server for img-f, and if the service that delivers images failed to update their SSL cert, that could cause problems. Identifying it is the hard part; once identified, usually getting the provider to fix it is easy.

Robin, from another thread also in the last day

I've been having the picture not loading problem for a while now. I usually use the dolphin browser on my phone (android). And if I click the image sometimes it'll load in the popup, sometimes it redirects my to the cloud image hosting page saying its not available.

I can't get any post related images to load.
The front pinside.com page images load, but anything embedded inside a post, does not show.
None of the commands in the above message work at my DOS prompt. Though ping does something, the above syntax is wrong. ping -c img-c.pinside.com (does not like the C option.) If I leave the "C" option out, I get the message, "ping request could not find host."

if I copy the URL from the above grahic a couple posts up, i get
https://img-f.pinside.com/201510/2731770/461489.jpg
and that image will not load.

pinsideproblem1.jpg

The above graphic, which I uploaded within my post, will not appear in my browser.

I was asked to do a DOS command "Tracert f-img.pinside.com" and it responded with:

"unable to resolve target system name f-img.pinside.com"

Your ability to get a response from ping or tracert does not "always" indicate a problem... sometimes your local carrier will block those protocols. The pictures are actually accessed over HTTP. So long as that is open.

I have received the "unable to resolve target system name f-img.pinside.com" message from tracert but have always been able to see the pictures just fine. I pinged the address, then did a tracert to the IP address, and it resolves just fine. After doing that, I can now tracert using the name.

For what it's worth... Mac

Pinging img.pinside.com [104.25.103.23] with 32 bytes

Reply from 104.25.103.23: bytes=32 time=36ms TTL=60

I haven't seen any images in threads for a few days and the playfield 'banners' on the top of the page aren't loading either.

More info:

If I try to open this link in a browser...

https://img-f.pinside.com/201510/2731770/461489.jpg

...Chrome comes back with:

"This webpage is not available

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

A secure connection cannot be established because this site uses an unsupported protocol."

If I change "https" to "http" in that link, the image loads fine, so it definitely seems to be a certificate issue.

How do you get certified? And why didn't this happen right at the start?
The whole pin side experience really sucks if there's no pictures.

Sorry, "img-f.pinside.com" cfh. Specifically: The broken image you can't load? Pick the hostname from that.

The SSL bit is curious. It suggests *either*: you're using a browser that doesn't meet the security requirements for the SSL (really TLS) protocol; or, there is an actual misconfiguration on the 104.25.103.23 server closest to you. "tracert 104.25.103.23" will be useful.

Internet nerdery follows:

The provider that operates the CDN actually has *several* sites using the same IP address, doing some trickery to make it appear in several places ("BGP TCP anycast"). This is why the tracert (or, for non-windows people having problems, "traceroute") is important to identify the specific location.

This trickery is intentional - the company that runs the CDN (Content Delivery Network) puts caches around the world. They do this so that the image you're looking at is likely to already be "local". It also reduces the load on Robin's server - a popular image may only be served by him ~50 times but shown to all of us as many times as it takes (50 times, or 5 billion times).

Anyone having this problem, please PM me with the following. Or, send it to my email jfesler at gigo.com .

• (non-windows terminal window) traceroute img-f.pinside.com
• (windows command window) tracert 104.25.103.23
• your public IP address at the moment - you can visit test-ipv6.com (my site) to see it
• what happens when you visit https://img-f.pinside.com/201510/2731770/461489.jpg
• what browser and version you're running (i.e., Chrome 45.0.2454.101)
• what operating system and version you're running (i.e., Windows 7 SP1)
  Windows: http://windows.microsoft.com/en-us/windows/which-operating-system
  Apple: Click that little apple icon in the upper left, and go to "About this Mac"
  Yes, OS version matters. Sometimes the browsers are limited to things the OS provides.

Anything you're not willing to post publicly, send it to me privately. If you do use email to send a picture (since pinside mail doesn't do pictures), please indicate in the subject your pinside name, and "cdn bug". Note that if you send me email, I might (gasp) learn your secret identity. IF that's a problem, then .. please transcribe the picture into words as exactly as possible and use pinside's PM.

Also, if you're having SSL problems..

What happens if you try another browser? I don't mean a different computer, I mean a different browser. If you normally use Chrome, try Firefox. If you usually use Firefox, try Chrome. If you usually use IE, try.. well, anything.

Apple iPhone users: there's really no alternative, all browsers are Apple's WebKit underneath.

using chrome. If i try and use IE, i can't even access pinside.com in any way shape or form!

I'm in the same boat...
https://img-f.pinside.com/201510/2731770/461489.jpg - can not access
http://img-f.pinside.com/201510/2731770/461489.jpg -- works fine

when using the https i get this:
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
A secure connection cannot be established because this site uses an unsupported protocol.

tracert 104.25.103.23
Tracing route to 104.25.103.23 over a maximum of 30 hops
1 4 ms 4 ms 4 ms 192.168.10.1
2 10 ms 13 ms 12 ms 10.158.64.1
3 10 ms 12 ms 11 ms dtr02wrlkmi-tge-0-1-1-3.wrlk.mi.charter.com [96.34.34.160]
4 14 ms 11 ms 11 ms dtr02fntnmi-bue-62.fntn.mi.charter.com [96.34.36.16]
5 20 ms 24 ms 13 ms dtr02dvsnmi-bue-61.dvsn.mi.charter.com [96.34.36.82]
6 13 ms 18 ms 15 ms dtr01dvsnmi-bue-60.dvsn.mi.charter.com [96.34.34.192]
7 15 ms 14 ms 16 ms crr02sgnwmi-bue-10.sgnw.mi.charter.com [96.34.32.187]
8 20 ms 15 ms 16 ms bbr01sgnwmi-bue-2.sgnw.mi.charter.com [96.34.2.58]
9 20 ms 20 ms 19 ms bbr01aldlmi-bue-5.aldl.mi.charter.com [96.34.0.54]
10 24 ms 29 ms 26 ms bbr01chcgil-bue-4.chcg.il.charter.com [96.34.0.99]
11 23 ms 23 ms 23 ms prr01chcgil-bue-2.chcg.il.charter.com [96.34.3.9]
12 21 ms 25 ms 25 ms xe-1-2-0.edge01.ord02.as13335.net [206.223.119.180]
13 23 ms 25 ms 24 ms 104.25.103.23
Trace complete.

Having no issues on iOS8 or my desktop running Chrome.

I'm having issues with images when using Chrome (also was having problems with Yahoo email) but went over to FireFox and no more problems. Still there with Chrome, though....

cfh,

• Which version of Chrome?
• Which version of Windows?
• What happens if you try Firefox?

Yes, that has an impact on that simple thing we see as "https" under the hood.

Norm,

• Which version of Chrome?
• Which version of [What OS?]
• Can you please do the tracert or traceroute as outlined in #13?

swinks, what about the other info from post #13 and 14? post here, or PM, or email to jfesler at gigo.com

my version of chrome is Version 45.0.2454.101
i don't understand why this is so difficult to resolve.
why are pictures hosted with https and not just http?
making that change would fix this issue.

Hosting pictures over HTTP would create browser warnings about mixed content, and may even block Pinside from being accessed.

cfh,

Thanks for (finally) sharing the Chrome version number.
I can tell you're running some kind of Windows, but I don't know what version. I reread your posts, and .. well, that's just not specified.

I'm also asking you to *compare* what Firefox does visiting https://img-f.pinside.com/201510/2731770/461489.jpg . Does it give an error?

cfh, norm, swinks

Please get me your IP address. You can PM me the info.
Please use a public site to get your IP address; don't look at your computer (that address will be your "inside' address).
You can use my site - http://test-ipv6.com - and just report to me the IPv4 address. The rest of that site doesn't matter for this problem, since Robin's site is not on IPv6.

This information will further be used to help identify what node(s) are responsible for serving you content.

I'm willing to help only if you guys are.

Simply complaining "This is only a pinside problem" won't solve a thing. I can counter argue "Pinside works great here, must be your end". The problem is actually elsewhere. And it takes more than complaints to resolve this.

The problems we're facing are the sort of things I deal with at my day job. I'm not asking for idle curiosity. I'm asking because these are the types of things that, if actually answered, gets us the factual data needed to resolve the problem. I'll further explain the why of everything to give you context. But be it known: I need your help, if you want to see this get resolved.

The problem is complex.

• The site uses HTTPS
• HTTPS really means potentially 6 different protocols
• Modern browsers restrict this to 3 different protocols - old ones are blacklisted due to being easy to hack now
• The different browsers have different policies as to which they allow, and this varies by version number of the browser.
• In the case of Windows, this also varies with the operating system.
• Browsers have to negotiate with the web site which one of the 6 to use
• The site that answers, has to have something in common with the browser.

And that's just the HTTPS bit.

This is why I ask about browser version, browser OS, and confirmation on the error message. This is why I ask you to try another browser, for comparison.

The image serving platform is complex, too. This platform is not Robin's - it is a 3rd party service called CloudFlare. They operate services around the globe.
network-map.png

Of course, if you're having troubles and reporting it in this thread, you can't see this picture. You can perhaps use http://proxybrowsing.com to have their_ site pull the images down, and show it to you over http. Don't use this for banking, folks.

Traffic first goes to CloudFlare; and only if they don't already have the image, will they ask Robin's server for it.

overview.png

That orange cloud is CloudFlare's cache service. There's one of those near where you live. As long as they've seen the image before, they can serve it directly, without hitting Robin's server at all. This lower's the bandwidth, cpu, and especially storage i/o on Robin's computer - all which contribute to helping his server stay fast enough for us to enjoy. Without CloudFlare, not only would images be slower, but all of pinside would be slower.

Now, how does this make the problem we're facing hard?

CloudFlare presents the same IP address to everyone for Pinside. Most web sites do this trick only for DNS; actual web serving is with a region-specific IP address. CF instead uses the same IP for serving, everywhere. This specific issues has been the subject of a tech talk in the network operator community.

What does this mean for you? When I ask you to look up the IP address, whether you're going to the east coast or west coast or the Dutch coast, you're going to see the same IP address. This is impossible to use to identify problem sites with CloudFlare. The one thing that helps identify the CloudFlare staff is: traceroute (or as you Windows people call it, tracert).

How does this help?

TerminalScreenSnapz001.png

By looking at the traceroute, CloudFlare engineers can look at the last couple of lines, and determine which of their 63 locations your'e hitting. This gives them something specific to look at and compare. I personally find the node I"m hitting works fine - on Safari 9.01, Mac OS X 10.11. Also on Chrome 45.0.2454.101, Mac OS X 10.11. This is useful data for CloudFlare - they can compare the site you're hitting, vs the site I'm hitting. They can compare the browsers we each respectively use.

Without the traceroute data, all we are doing when we report the problem to CloufFlare is .. whining.

When I ask for the IP address, this is more so that CloudFlare can help identify if there are routing policies that they need to examine, to better understand which node you're hitting.

So, in summary, I need *all* of this, to make a difference. Which means, if you're affected, I need you to contribute fully.

For each browser you try:

• Browser - with exact version
• OS - with exact version.
• Exact observation of what happens when you visit https://img-f.pinside.com/201510/2731770/461489.jpg . The actual error message is important.
• tracert or traceroute to img-f.pinside.com
• Your actual public IPv4 address (perhaps using http://test-ipv6.com/) (PM this, don't post publicly)

And, I need you to try more than one browser, with the same detail as the your primary browser. I'm not asking you to switch browsers entirely - but please compare and report.

Agent57: Thanks - you're the one out of four that have given me everything I've asked for.

-------------

FAQ:

Why can't the images just skip https?: If the page is https, then all assets (images, javascript, anything else that has to be remotely loaded) must also be https. This is a security feature of the browser to warn when something is going insecure. The better question is, whether Robin would entertain the thought of not forcing https on everyone. Really discussing that topic is .. political, and it involves the country most of the posters here live in. That said, the world is going towards https.

You had me at "I'm willing to help..."

you_had_me_at.jpg

Big thanks for all your help Jason! Everything you write is correct. In fact it's a perfect explanation of why I use a CDN (Cloudflare) and the challenges of fixing this seemingly complex problem. Without proper feedback from the people who are actually seeing the image-not-loading error, this is nearly impossible to fix.

So please, if you are having problems with forum images not loading, PM Jason (Jfesler) the details he is requesting. Thanks for the help!

More info from the provider (I'll edit my instructions later tonight).

Anyone please get:

Output of http://img-f.pinside.com/cdn-cgi/trace . PM me, or email [email protected] . Let me know your pinside name if you email me, so I can update the spreadsheet with who has what hard evidence of a problem.

If possible, get the HAR file using Chrome. I don't know if this will work for failed images though.
https://support.cloudflare.com/hc/en-us/articles/203118044-How-do-I-generate-a-HAR-file-

Do this from the browser that's failing for you. If you can't, indicate such. If you ARE able to get the HAR, then email it to me - [email protected] . Again, let me know the pinside name. Or, post the file somewhere, and PM me a URL to fetch, if you want to protect your identity from shady people like me. That said, I'd hope you can search for me and get some sense of trust of who I am.

-jason

When you do a trace, do it without "http://" or the trailing "/"

traceroutes expect hostnames or address, not entire URLs. yeah, I know, the apps are picky.

For those of you having SSL errors, I noticed you're all using Windows XP.

I wonder if you're running into this.

From this Chrome bug ticket:

Chrome uses the operating system's certificate verifier. On Windows XP, this means we can't verify ECDSA certificates. I'm afraid there isn't much we can do here, short of building out our own verifier and switching to it on Windows.

This basically says:

• Chrome uses Window's built in SSL verification
• CloudFlare is using more modern standards.
• Windows XP's implementation is dated.
• Firefox should work even if Chrome doesn't - as Firefox doesn't use Windows to do the verification.

Another related ticket is here with much the same response from the Chrome developers.

Robin is paying CloudFlare for an account that should permit Chrome/IE on Windows XP to work.

But certainly something could have gone wrong.

I'm not aware of the status of the CloudFlare ticket - it is getting late in Robin's time zone.

Both CFH and Agent57 have responded to me (off-thread) saying that it now works. That's both "ERR_SSL_VERSION_OR_CIPHER_MISMATCH" use cases that were documented.

Norm says things are just slow on Safari, but fast on Firefox.

Common theme: Windows XP. Yeah, I said it.

----

Swinks confirms that the first time visiting a page with pics, slow - and the second time (with the other browser) is fast. This is actually expected behavior when you're the first person in the region checking recently uploaded photos. I suspect you're hitting the slowness more often due to time of day, compared to the other ~250 people in your country. (And of the ~250, I'm not sure how many are *active*). As the first person asking for an image in your part of the world, the cache has to fetch the image - on demand. The second view of the same image in your area will be a lot faster..

I got a reply from Cloudflare:

This issue is actually a bug in Chrome. Windows XP cannot properly verify ECDSA signatures, but Chrome's TLS ClientHello advertises that it can, which breaks SSL functionality for users using Chrome on XP.

A fix for this is in review:

https://boringssl-review.googlesource.com/#/c/6130/
https://codereview.chromium.org/495663002/
https://code.google.com/p/chromium/issues/detail?id=409901

TLDR: This is an issue for Chrome on XP. Use a different browser if you're still on XP (cough, cough, update OS, cough) or hope an update for Chrome will soon fix this!