Facebook Messenger API “URL COULD NOT BE VALIDATED”

Question

I'm trying to setup the Facebook messenger API and I'm getting this error when I attempt to add the WebHook:

The URL couldn't be validated. Callback verification failed with the following errors: curl_errno = 60; curl_error = SSL certificate problem: unable to get local issuer certificate; HTTP Status Code = 200; HTTP Message = Connection established

I've setup my NodeJS server using the code they provided in the tutorial. Here's the url: https://stackoverload.me/chatter/webhook

EDIT HERE'S THE RESOLUTION (someone wanted to see the code):

var express = require('express');

var fs = require('fs');
var https = require('https');

var app = express();
app.use(express.static('public'));

// SSL
https.createServer(
    {
        ca: fs.readFileSync(__dirname + '/server.ca'),
        key: fs.readFileSync(__dirname + '/server.key'),
        cert: fs.readFileSync(__dirname + '/server.cert')
    }
, app).listen(443, function() {
    console.log('Server is now running.');
});

// HTTP redirect to SSL
express()
    .get('*', function(req,res){
        res.redirect('https://example.com' + req.url)
    })
    .listen(80);

Answer 1

Forgot to answer this, but I found out that I added a ca file and parameter to my https server and Facebook then accepted it.

Answer 2

You can use the chained certificate by the following shell:

cat www.example.com.crt bundle.crt > www.example.com.chained.crt

From http://nginx.org/en/docs/http/configuring_https_servers.html#chains

Answer 3

Was trying to setup FB messenger webhook with a strong verify token. Somewhat like this: o\/ERviEE\/vt0|<E|\|

The same is been verified in the code:

req.query['hub.verify_token'] === 'o\/ERviEE\/vt0|<E|\|'

However, the value received from FB is: o\\/ERviEE\\/vt0|<E|\\|

This is strange. There seems to be no document reference as such which talks about how Facebook escapes special characters for verify tokens or alike. Not sure if this happens for other entities as well.

Conclusion: need to be a little bit cautious when using special characters for verify tokens.

Because, Facebook escapes special characters for webhooks' verify tokens.