[SSL] What to check if an OGP image display error occurs

The other day, we received a consultation from a website that said, “When posting the URL of an article page on social media, OGP (Open Graph Protocol) images are not displayed correctly.”

I thought it was a misconfiguration of the OGP meta tag on the website (WordPress, etc.), but the settings were fine. And even though I checked with a third-party OGP verification tool and found no problems, the OGP images would not display when I used actual social media debugger tools (such as X or Facebook) or on the social media posting screen, and an error occurred.

Missed update of “SSL intermediate certificate” that is not visible from the site surface

To cut to the chase, the cause was “missing to update the SSL intermediate certificate.”

SSL intermediate certificates are usually overlooked, but they finally come to light when problems occur with the process of retrieving social media previews, such as with OGP images.

SSL certificates consist of a server certificate (domain certificate) and the supporting intermediate certificate. In many environments, you might think that updating just the server certificate is all you need, but in fact, some clients (particularly social media crawlers) can fail SSL communication if the intermediate certificate expires or is forgotten to be updated.

The tricky thing about these cases is that the website itself continues to display normally, so it’s difficult for users to notice the problem.

What I tried when OGP images were not displayed

This time, we identified and resolved the cause using the following steps.

① Recheck OGP with the debugger tool for SNS (e.g. X, Facebook, etc.) → Failed to obtain image

② Recheck that there are no problems with the OGP tag or image URL → No problem

③ Check the server’s SSL information with the curl command or SSL checker → Intermediate certificate is old or missing

④ Update the intermediate certificate on the server side and reconfigure it appropriately

⑤ Reload with the SNS (e.g. X, Facebook, etc.) debugger → OGP image is displayed normally

Check with an SSL checker

If an intermediate certificate is outdated or missing, and you check it with an SSL checker like the one below, you will get the following result.

https://rakko.tools/tools/45

If intermediate certificate updates are missing

< If intermediate certificate updates are missing >

When the intermediate certificate update is complete

After that, if you try it with the debugger tool of SNS (e.g. X), the status of the debugger tool will also be displayed as successful.

< When the intermediate certificate update is complete >

Summary

SSL certificate renewal requires “intermediate certificates included”

Don’t rest easy just by updating your server certificate, be sure to check the expiration date and installation status of your intermediate certificate. Especially for websites that have a lot of social media sharing or external integration, these SSL layer defects can cause unexpected problems.

◆ Even if your website is displayed correctly, if OGP images do not appear on social media, it may be an SSL-related problem.

◆ In particular, expired intermediate certificates and configuration errors can easily lead to invisible problems.

◆ When updating your SSL certificate, be sure to check the update and application of not only your server certificate but also your intermediate certificate.

If an error like this occurs, we recommend that you review your server settings, or if you are unable to configure them yourself, consult with your server management company.

● Website creation, server construction/operation ●