"Empty response received" when using HTTPS

Question

I have a Facebook app that has been working with HTTP and HTTPS for some time. Recently - about a week ago I think - HTTPS stopped working. It now gives a 'Empty response received.' message every single time.

My server DOES have an SSL cert and HTTPS works on the server. It is not a commercial cert though, it is self-signed.

I know HTTPS is going to be a requirement in October... does anyone know:

1) What might be causing the empty response errors, and

2) What the requirements are for an acceptable SSL cert, according to Facebook? Self-signed no longer seems to cut it...

Answer 1

I've been noticing the same problem for the last few weeks as well. Here's what I've been able to learn, maybe this will help you.

The problem seems to be intermittent, it happens at some times of day and not others. Sometimes it happens only for some users. I had setup a test page that just says Hello World in HTML and nothing else, and I still get the error. I checked my access logs and facebook isn't hitting even hitting my server.

I am using Canvas. I had set my Canvas URL to https://. When I changed this to http://, the problem went away. I had set my Secure Canvas URL to https://, and still got this problem. I blanked this out since it was giving the error.

Another thing - check the HTTP status code that is returned by your canvas page - make sure it is 200. At one point, we were redirecting http to https which returned a 302 status and facebook didn't like that and gave this error.

Answer 2

A self signed certificate is not adequate for presentation to an end user. Even if facebook "allowed" it, the users browser would show a security exception first. Godaddy has very inexpensive SSL certificates.