On my Linux machine Imagemagick will load the HTTPS duckduckgo file but not the one from Facebook.
Code: Select all
<bjn@sponvoid:/tmp>$ convert https://duckduckgo.com/assets/logo_homepage.normal.v102.png d.png
<bjn@sponvoid:/tmp>$ convert "https://graph.facebook.com/4/picture?width=177&height=113" out.jpg
convert: unable to open image `/tmp/magick-dMA39w4a': @ error/blob.c/OpenBlob/2587.
convert: unable to open file `/tmp/magick-dMA39w4a': @ error/constitute.c/ReadImage/571.
convert: missing an image filename `out.jpg' @ error/convert.c/ConvertImageCommand/3011.
<bjn@sponvoid:/tmp>$
Looking at curl's output, which may provide clues:
Code: Select all
<bjn@sponvoid:/tmp>$ curl -v https://duckduckgo.com/assets/logo_homepage.normal.v102.png >/dev/null
* About to connect() to duckduckgo.com port 443 (#0)
* Trying 50.18.192.250... % Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0connected
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Server hello (2):
{ [data not shown]
* SSLv3, TLS handshake, CERT (11):
{ [data not shown]
* SSLv3, TLS handshake, Server key exchange (12):
{ [data not shown]
* SSLv3, TLS handshake, Server finished (14):
{ [data not shown]
* SSLv3, TLS handshake, Client key exchange (16):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Finished (20):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
{ [data not shown]
* SSLv3, TLS handshake, Finished (20):
{ [data not shown]
* SSL connection using ECDHE-RSA-RC4-SHA
* Server certificate:
* subject: serialNumber=evVwiDo-ql6zOlrQXqCb6FI6kq2HyL1z; OU=GT00431633; OU=See www.rapidssl.com/resources/cps (c)12; OU=Domain Control Validated - RapidSSL(R); CN=*.duckduckgo.com
* start date: 2012-10-28 19:42:01 GMT
* expire date: 2013-11-30 19:34:29 GMT
* subjectAltName: duckduckgo.com matched
* issuer: C=US; O=GeoTrust, Inc.; CN=RapidSSL CA
* SSL certificate verify ok.
> GET /assets/logo_homepage.normal.v102.png HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: duckduckgo.com
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 19 Sep 2013 21:04:25 GMT
< Content-Type: image/png
< Content-Length: 21612
< Last-Modified: Wed, 11 Sep 2013 20:53:14 GMT
< Connection: keep-alive
< ETag: "5230d83a-546c"
< Expires: Fri, 19 Sep 2014 21:04:25 GMT
< Cache-Control: max-age=31536000
< Cache-Control: public
< Accept-Ranges: bytes
<
{ [data not shown]
100 21612 100 21612 0 0 141k 0 --:--:-- --:--:-- --:--:-- 178k
* Connection #0 to host duckduckgo.com left intact
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
} [data not shown]
<bjn@sponvoid:/tmp>$
That has returned the image right away. Now the Facebook image:
Code: Select all
<bjn@sponvoid:/tmp>$ curl -v "https://graph.facebook.com/4/picture?width=177&height=113" >/dev/null
* About to connect() to graph.facebook.com port 443 (#0)
* Trying 31.13.76.8... % Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0connected
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Server hello (2):
{ [data not shown]
* SSLv3, TLS handshake, CERT (11):
{ [data not shown]
* SSLv3, TLS handshake, Server key exchange (12):
{ [data not shown]
* SSLv3, TLS handshake, Server finished (14):
{ [data not shown]
* SSLv3, TLS handshake, Client key exchange (16):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Finished (20):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
{ [data not shown]
* SSLv3, TLS handshake, Finished (20):
{ [data not shown]
* SSL connection using ECDHE-RSA-AES128-SHA
* Server certificate:
* subject: C=US; ST=California; L=Palo Alto; O=Facebook, Inc.; CN=*.facebook.com
* start date: 2013-04-11 00:00:00 GMT
* expire date: 2016-03-05 23:59:59 GMT
* subjectAltName: graph.facebook.com matched
* issuer: C=US; O=VeriSign, Inc.; OU=VeriSign Trust Network; OU=Terms of use at https://www.verisign.com/rpa (c)10; CN=VeriSign Class 3 Secure Server CA - G3
* SSL certificate verify ok.
> GET /4/picture?width=177&height=113 HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: graph.facebook.com
> Accept: */*
>
< HTTP/1.1 302 Found
< Access-Control-Allow-Origin: *
< Cache-Control: private, no-cache, no-store, must-revalidate
< Content-Type: image/jpeg
< Expires: Sat, 01 Jan 2000 00:00:00 GMT
< Location: https://fbcdn-profile-a.akamaihd.net/hprofile-ak-ash1/c0.0.160.160/p160x160/202896_4_1782288297_n.jpg
< Pragma: no-cache
< X-FB-Rev: 941825
< X-FB-Debug: VLHMe2cQho+bfSPH/h/k8ZzpI8JqbeEWec/J1jKusOQ=
< Date: Thu, 19 Sep 2013 21:04:35 GMT
< Connection: keep-alive
< Content-Length: 0
<
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
* Connection #0 to host graph.facebook.com left intact
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
} [data not shown]
<bjn@sponvoid:/tmp>$
Note that Facebook has returned a 302 redirect code and a Location header. If I switch on following Location headers:
Code: Select all
<bjn@sponvoid:/tmp>$ curl -vL "https://graph.facebook.com/4/picture?width=177&height=113" >/dev/null 0|14:04
* About to connect() to graph.facebook.com port 443 (#0)
* Trying 31.13.76.8... % Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0connected
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Server hello (2):
{ [data not shown]
* SSLv3, TLS handshake, CERT (11):
{ [data not shown]
* SSLv3, TLS handshake, Server key exchange (12):
{ [data not shown]
* SSLv3, TLS handshake, Server finished (14):
{ [data not shown]
* SSLv3, TLS handshake, Client key exchange (16):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Finished (20):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
{ [data not shown]
* SSLv3, TLS handshake, Finished (20):
{ [data not shown]
* SSL connection using ECDHE-RSA-AES128-SHA
* Server certificate:
* subject: C=US; ST=California; L=Palo Alto; O=Facebook, Inc.; CN=*.facebook.com
* start date: 2013-04-11 00:00:00 GMT
* expire date: 2016-03-05 23:59:59 GMT
* subjectAltName: graph.facebook.com matched
* issuer: C=US; O=VeriSign, Inc.; OU=VeriSign Trust Network; OU=Terms of use at https://www.verisign.com/rpa (c)10; CN=VeriSign Class 3 Secure Server CA - G3
* SSL certificate verify ok.
> GET /4/picture?width=177&height=113 HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: graph.facebook.com
> Accept: */*
>
< HTTP/1.1 302 Found
< Access-Control-Allow-Origin: *
< Cache-Control: private, no-cache, no-store, must-revalidate
< Content-Type: image/jpeg
< Expires: Sat, 01 Jan 2000 00:00:00 GMT
< Location: https://fbcdn-profile-a.akamaihd.net/hprofile-ak-ash1/c0.0.160.160/p160x160/202896_4_1782288297_n.jpg
< Pragma: no-cache
< X-FB-Rev: 941825
< X-FB-Debug: RcZphz9BBJZWNyp6e8JTtcIfAwcDAEcmzNB2QECKmaw=
< Date: Thu, 19 Sep 2013 21:04:49 GMT
< Connection: keep-alive
< Content-Length: 0
<
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
* Connection #0 to host graph.facebook.com left intact
* Issue another request to this URL: 'https://fbcdn-profile-a.akamaihd.net/hprofile-ak-ash1/c0.0.160.160/p160x160/202896_4_1782288297_n.jpg'
* About to connect() to fbcdn-profile-a.akamaihd.net port 443 (#1)
* Trying 23.59.189.211... connected
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Server hello (2):
{ [data not shown]
* SSLv3, TLS handshake, CERT (11):
{ [data not shown]
* SSLv3, TLS handshake, Server finished (14):
{ [data not shown]
* SSLv3, TLS handshake, Client key exchange (16):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Finished (20):
} [data not shown]
* SSLv3, TLS change cipher, Client hello (1):
{ [data not shown]
* SSLv3, TLS handshake, Finished (20):
{ [data not shown]
* SSL connection using AES256-SHA
* Server certificate:
* subject: C=US; ST=MA; L=Cambridge; O=Akamai Technologies, Inc.; CN=a248.e.akamai.net
* start date: 2013-07-24 17:49:01 GMT
* expire date: 2013-12-31 18:47:42 GMT
* subjectAltName: fbcdn-profile-a.akamaihd.net matched
* issuer: C=US; O=GTE Corporation; OU=GTE CyberTrust Solutions, Inc.; CN=GTE CyberTrust Global Root
* SSL certificate verify ok.
> GET /hprofile-ak-ash1/c0.0.160.160/p160x160/202896_4_1782288297_n.jpg HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: fbcdn-profile-a.akamaihd.net
> Accept: */*
>
< HTTP/1.1 200 OK
< Content-Type: image/jpeg
< Last-Modified: Fri, 05 Jul 2013 19:49:34 GMT
< Content-Length: 4977
< Access-Control-Allow-Origin: *
< Cache-Control: max-age=1209600
< Expires: Thu, 03 Oct 2013 21:04:49 GMT
< Date: Thu, 19 Sep 2013 21:04:49 GMT
< Connection: keep-alive
<
{ [data not shown]
100 4977 100 4977 0 0 41093 0 --:--:-- --:--:-- --:--:-- 41093
* Connection #1 to host fbcdn-profile-a.akamaihd.net left intact
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
} [data not shown]
* Closing connection #1
* SSLv3, TLS alert, Client hello (1):
} [data not shown]
<bjn@sponvoid:/tmp>$
Back to the Mac, I confirm that it can grab the HTTPS duckduckgo image just fine.
So the bug isn't to do with HTTPS, it's to do with handling redirects and Location headers.
Updated the thread subject to reflect.
