Zone Telechargement shows an SSL error on every Feed

[sysadminstory]

Describe the bug
Zone Telechargement bridge does not work because of an SSL error :
Young Sheldon - Saison 5 Qualité WEB-DL 720p | VOSTFR - Zone Telechargement was unable to receive or process the remote website's content!
Error message: Unexpected response from upstream. cUrl error: SSL certificate problem: unable to get local issuer certificate (60) PHP error:
Query string: action=display&bridge=ZoneTelechargement&context=Suivre+la+publication+des+%C3%A9pisodes+d%27une+s%C3%A9rie+en+cours+de+diffusion&url=telecharger-serie%2F82405-telecharger-young-sheldon-saison-5-saison-5-web-dl-720p-vostfr.html&filter=both&format=Atom
Version: dev.2021-04-25

To Reproduce
Steps to reproduce the behavior:
Create any Feed with Zone Telechargement bridge

Expected behavior
Shows the feed content

Screenshots

Additional context
I'll try to fix this issue in the next days !

[dvikan]

curl "https://zone-telechargement.stream/" -I
curl: (60) SSL certificate problem: unable to get local issuer certificate

https://decoder.link/sslchecker/zone-telechargement.stream/443

I believe they are missing a third cert in their cert chain. Might be related to prior issues with expiration of letsencrypt root ca.

Some solutions here: #2397

[ORelio]

I had something similar in Anidex and did the following in #1693:

1. Disable certificate validation before performing requests:

rss-bridge/bridges/AnidexBridge.php

Lines 139 to 142 in 37cb409

	// The HTTPS certificate presented by anidex.moe is for anidex.info. We need to ignore this.
	// As a consequence, the bridge is intentionally marked as insecure by setting self::URI to http://
	$opt[CURLOPT_SSL_VERIFYHOST] = 0;
	$opt[CURLOPT_SSL_VERIFYPEER] = 0;

This is essentially the same thing as @dvikan mentioned above.

2. Intentionally mark bridge as insecure by setting URL to http:// instead of HTTPS

rss-bridge/bridges/AnidexBridge.php

Line 6 in 37cb409

const URI = 'http://anidex.info/'; // anidex.info has ddos-guard so we need to use anidex.moe

You may manually change back to HTTPS dynamically by adding something like self::URI = str_replace('http://', 'https://', self:URI); before performing requests. The point is to let the user know that the requests will be insecure, because certificate validation is disabled. This is not really a big deal for content scrapping since nothing sensitive is done (no credentials...) but still better to let the user know about it.

[sysadminstory]

Hello !

Thanks for your help :)

I was offline for a several days, so I did not have time to search a solution !

Those old URLs are missing some intermediate certificate, and therefore cURL is complaining about the SSL chain being incomplete (and I think, they won't be fixed, because no one should us them anymore !).

I think I found a solution without bypassing SSL verification, but I must do additional testing, and maybe I could do only one HTTP request, instead of two !

Stay tuned !

[ORelio]

It's even better if you can fix it without bypassing 👍

[sysadminstory]

The PR #2426 should fix this issue :)
(without bypassing SSL verification 😅)