Facebook Messenger Platform. Setting up webhook with SSL

Question

Finally Facebook launched API for their messenger API for their messenger. This will allow us to create chat bots.

In getting started guide, I need to setup webhook. This requires webserver which resides in specific domain and must use SSL connection.

I have VPS which has static IP. I made self signed certificate and created simple Node JS web server which uses this certificate. First of all I need to verify token for webhook:

app.get('/webhook/', function (req, res) {
  if (req.query['hub.verify_token'] === '<validation_token>') {
      res.send(req.query['hub.challenge']);
  }
  res.send('Error, wrong validation token');
})

Then I launched this server application and In my facebook app dashboard I click to Verify and Save button.

It throws me this error message:

This means that Facebook does not want to accept my self signed certificate.

This brings a several questions:

Do I need to use SSL certificates only provided by Certificate Authorities in order to work with facebook messenger?

Working with Facebook messenger is far more difficult than Telegram.

Motherofpearl

I wonder how are you doing development locally in absence of https? – Tiresias

I code locally, then upload it to my VPS via git and launch there. – Motherofpearl

thanks for your reply, referring the sample code, I am getting error: Parse error: syntax error, unexpected ',', expecting variable (T_VARIABLE) . How to run that code and verify my weebhook? – Tiresias

Answer 1

You can use cloudflare to get https instead of self-sign. Or you can use https://letsencrypt.org

Hyman

Hi, I have the same issue though my certificates are from COMODO for the domain and they work fine with the apache but i can't get them to work with flask and this url verification.. here is my issue: #36642505 – Jodiejodo

letsencrypt doesn't work for IP address domains, which stinks for localhost development. – Kerekes

Answer 2

For just test you can use localtunnel. https://localtunnel.me/

Orontes

Nice, this solves both the SSL problem and the problem with forwarding the request to my local machine. – Fervid

While debugging with frequent restarts to node, we have to recreate tunnels and update Webhook configs. This is a bit of a let down. Can someone post correct process for Letsencrypt? – Hollow

@Fervid Is it working fine for you? I also want a secure local connection for WebHooks – Tiresias

@Hollow just add "-s <subdomain>" so the domain stays the same and you don't have to update the Webhook config. – Fervid

@Tiresias it is working ok, localtunnel loses the connection from time to time, but still good enough. – Fervid

"The URL randomly-generated-part.loca.lt/webhookendpoint has been identified as malicious and/or abusive." - FYI Getting this message when trying to use localtunnel for FB webhook. – Amena

Answer 3

I deployed my bot to Heroku, and they readily offers an HTTPS connections. For local development, I use ngrok, which also supports HTTPS forwarding.

For new comers, I wrote this small tutorial for those who want to get started with the Facebook Messenger (Bot) API, from the first line of code to Heroku deployment. I found out that Heroku was a perfect fit for such a project, since I used Python flask + gunicorn, all I needed for deployment really took 5 minutes to set up, and Heroku took care of the rest.

Eccentric

This answer helped me. And your blog link too. Thanks @hung-tran – Kulsrud

@Hung Tran I already used ngrok but I got following SSL error. <b>Fatal error</b>: Curl failed with error #60: SSL certificate problem: unable to get local issuer certificate in <b>C:\xampp\htdocs\webhook.php</b> on line <b>55</b><br /> Can you please tell me how can I solve it. – Clicker

Answer 4

Extracted from here:

New webhook subscriptions must use a secure HTTPS callback URL as of v2.5. With the next version of the Graph API we will stop sending updates to non-HTTPS callback URLs.
If you need more information about setting up HTTPS for your callback URL, check out the Getting Started guide from Let's Encrypt and the SSL Certificate Installation instructions from Digicert.

And from here, and like @saturngod said:

Self signed certificates won't be accepted by facebook. Letsencrypt certificates works perfectly.

Bloodsucker

Answer 5

To verify web hook use :-

$_REQUEST["hub_token"] and $_REQUEST["hub_challenge"];

First verify token to your page token and then print :-

echo $_REQUEST["hub_challenge"];
exit;

Walliw

Answer 6

I had the same error using Comodo SSL on Apache. In my case I was missing the SSLCertificateChainFile and just had to upload that bundle file and the path to file in my virtual host config and reload apache. Here is a link to install comodo SSL purchased from ssls.com https://helpdesk.ssls.com/hc/en-us/articles/203482651-How-to-install-a-SSL-certificate-on-Apache.

Camus