Intermittent ERR_SSL_PROTOCOL_ERROR error for cross domain request

Question

The users of my website are seeing intermittent ERR_SSL_PROTOCOL_ERROR when making cross domain requests to api.flickr.com

By intermittent I mean that I've seen this happen 4 times out of ~1200 requests to the api yesterday.

Failed to load resource: net::ERR_SSL_PROTOCOL_ERROR     https://api.flickr.com/services/rest/?method=flickr.photos.getInfo&api_key=.....

My site is and AngularJS application running on Google App Engine and is exclusivley avalable on HTTPS.

sslchecker shows that my site's certificate & certificate chain is installed correctly. Well, I think it looks ok!

sslchecker for api.flickr.com shows that ROOT 1 of the certificate chain is missing. Is that the problem? Is there any way around that for me?

Any other ideas? Is the problem that our certificates are issues by different authorities maybe?

Edit - Some other possibly relevant info gleaned from google analytics

• Have seen it happen for different OSes - Android, iOS, Windows
• Different browsers - Android, Chrome, Safari
• Different Network Domains

Solution 1

Persistent SSL Protocol Errors may be caused by problems like

• the destination server expects a different protocol (e.g. SSLv1, SSLv2, SSLv3)

• a violation of a security policy (e.g. some servers don't honor certificate requests made from client)

• Firewall impedance filtering / ciphering

---

Intermittent SSL Protocol Errors are very hard to diagnose. They can be the result of expired session, expired key, connectivity hiccup, lost packets, etc

Even worse, they can be caused by Server Side issues like date-time sync, server connection pool full, etc.

Best practice is to re-send the request: because such issues are often a temporary glitch, and usually succeed at 2nd attempt.

---

Flickr switched their API to SSL-only on June 27th, 2014 (a little under a year). Their Forum has blown up with SSL related problems since then.

In the past few months many users have reported (check thread) sporadic SSL Protocol Errors.

These Protocol Errors appear across all device types (laptops, desktops, mobile, Linux, Windows, etc) and usually an immediate re-try is successful. The commonality and highly infrequent nature of these problems indicates there is some issue on the host side completely unrelated to anything on the client.

Since a re-fresh or 2nd attempt is usually successful, I suggest trapping the error, and making 1-3 more attempts:

var promise = flickrService.get(...);

promise.success(function (data, status, headers, config) {
        // Big Party
    })
    .error(function(data, status, headers, config) {
        if (status == 107) {
            promise = flickrService.get(...);

            promise.success(function (data, status, headers, config) {
                    // Big Party
                })
                .error(function (data, status, headers, config) {
                    AlertService.RaiseErrorAlert("Flickr temporarily unavailable.Please try again later");
                });
        }
    });

If you continue to get a "Protocol Error", then inform the user that Flickr is temporarily unavailable and to try again later.

Solution 2

This might be the answer, but i'm guessing that this is probably not a client issue, so i would suggest you to update your api's server with that line added in the header :

Access-Control-Allow-Origin: https://api.flickr.com/*

This should fix the troubles some of your users are facing.

Solution 3

if you run into this error and you are testing localhost endpoint just make sure you use http instead of https as your url.

eg: http://localhost:8080/ not https://localhost:8080/

Comments

[tx802]

In case it's relevant, are you calling the API through App Engine's URLFetch service, or directly from your AngularJS client?

[Harry Lime]

Invoking directly using $http.get(flickrUrl) .success(successCallback).error(errorCallback);

[New Dev]

Is the error consistently appearing for the same user?

[Dave Alperovich]

This did not sound like a problem your end. Certificates are usually good or not, and once you are in Secure mode, querying an external API should not come up with a protocol problem unless Flickr is having issues with something like date. As it turns out, there have been multiple reports of such intermittent problems with Flickr this calendar year. For example: flickr.com/help/forum/en-us/72157648704562424

[Dave Alperovich]

This seems like an internal issue with maintaining time across time zones. I suggest you raise a ticket with them internally, as even the help forum people admitted they were assisting each other without admin assistance. My suspicion is that there is nothing Flickr can do for you or your app specifically. As I keep pointing out, this seems to be a maintenance / admin issue

[Harry Lime]

@NewDev no different users... different devices types, etc.

[Harry Lime]

@DaveAlperovich yes that thread looks relevant - thanks

[Dave Alperovich]

@HarryLime, suggest you get screen shot of and send to Andrew Stadlen on the flickr forum flickr.com/photos/adstads

[Strawberry]

If its flickr, then he's at the mercy of flickr.