Certificate for *.api.oneall.com expired Saturday, August 2, 2025 at 7:59:59 PM

Ian_Lipliavyi

Hello,

I thought it was just my problem, but I think it's everyone's problem:

https://example.api.oneall.com/socialize/redirect.html?provider_connection_token=345345

Your connection is not private
Attackers might be trying to steal your information from example.api.oneall.com (for example, passwords, messages, or credit cards). Learn more about this warning

Certificate info:
Common Name (CN) *.api.oneall.com
Organization (O)
Organizational Unit (OU)
Common Name (CN) Sectigo RSA Domain Validation Secure Server CA
Organization (O) Sectigo Limited
Organizational Unit (OU)
Issued On Thursday, August 1, 2024 at 8:00:00 PM
Expires On Saturday, August 2, 2025 at 7:59:59 PM

Could the team take a look?

Regards,
Ian

Valentin_Konichu

Oh It's finally back

Greg_Chiasson

Nothing helpful to add here other than to say that it's impacting my install as well - the wildcard cert means it's pretty much everyone having the same problem, and I haven't found a workaround that resolves it. Turning off SSL/HTTPS and using HTTP over port 80 in the plugin settings doesn't help either, because then Chrome just blocks it for being insecure content on a secure page. I tried downloading library.js and serving it from our instance, and that doesn't work either because the API connections fail. The only workaround I can figure would be to set up our own proxy (with a valid cert) and handle the requests to api.oneall.com behind that (where I can have the https library ignore cert errors) but I feel like by the time I got that stable and deployed the SSL cert issue would be resolved anyway, so I'm loathe to do it.

Anyway, just replying to bump the thread and help it get noticed.

John_Ny

I noticed today my website log in button was missing. When I went into my site and try to verify my API Credentials it says "Could not contact API. Is the API connection setup properly?". Is this Certification issue most likely the cause of these problems?

Ian_Lipliavyi

-- Is this Certification issue most likely the cause of these problems?

Right. Refresh the page and take a look to "inspect" (right mouse button) -> network, you will see red line "library.js" ERR_CERT_DATE_INVALID, if you click in this line the page "https://.api.oneall.com/socialize/library.js" with

Your connection is not private
Attackers might be trying to steal your information from enot66com.api.oneall.com (for example, passwords, messages, or credit cards). Learn more about this warning

Or just open this - https://example.api.oneall.com/socialize/redirect.html?provider_connection_token=345345

The same result.

Take a look into the certificate (left from URL in browser search line) and you will see:

Issued On Thursday, August 1, 2024 at 8:00:00 PM
Expires On Saturday, August 2, 2025 at 7:59:59 PM

Expired 2 days ago.

Bret_Lipscomb

Same issue here. It is affecting, I assume, all consumers of the API. This same issues occurred last expiration and they don't seem to set reminders for their SSL certs to renew timely. This is unacceptable for businesses that rely on this connection and pay the premium.

Ian_Lipliavyi

-- This is unacceptable for businesses that rely on this connection and pay the premium.

I worked for a company that makes computer games (everyone here knows it) on a game that makes billions a year.

And there, because of a configuration error, people couldn't pay for in-game purchases for a week and a half. I can't imagine how much money the company lost.

At the same time, there were tens of thousands of error messages on the forum inside the game, but for some reason they weren't noticed.

So it happens.

Greg_Chiasson

It's pretty funny that the SSL cert doesn't just auto-renew, or like maybe they could buy one that lasts longer than a year. 364 days a year the plugin works great but I'm starting to dread early August every time.

Ian_Lipliavyi

Wow!

OneAll address is:

ONEALL SARL
4, Rue A. Graham Bell
L-3235 Bettembourg
Luxembourg (Europe)

Now:
2:33 p.m.
Monday, August 4, 2025 (GMT+2)
Time in Luxembourg

Are they going to wake up there or what?

Roman_Shishatsky

Same problem -
Could not contact API. Is the API connection setup properly?
The error appeared yesterday.

Alex_Camelio

Same issue here. When will this be corrected?

Valentin_Konichu

Same issue, so that means that the " by more than 300,000 websites worldwide, including small blogs, growing startups and large corporate enterprises. " do not have a way to log in ?

Ian_Lipliavyi

--Same issue, so that means that the " by more than 300,000 websites worldwide, including small blogs, growing startups and large corporate enterprises. " do not have a way to log in ?
Yes :-)

LinkedIn says they have 2-10 employees. Maybe they are all on vacation :-)

David_Judge

Same issue here, hopefully this will be restored soon. Thanks all. I messaged them on linkedin as well.

Ivan_Gavrilov

The same problem. There was a similar issue with the certificate last year.

Ian_Lipliavyi

-- The same problem. There was a similar issue with the certificate last year.

Right - "SSL Certificate Exipired : library.js"

But as far as I understand it was fixed in one day.

Ivan_Gavrilov

But as far as I understand it was fixed in one day.

Here's last year's topic about a similar problem:
https://support.oneall.com/forums/discussion/8587/ssl-certificate-exipired-library-js

Dan_Willett

Left a support ticket ... it has been 4 days and the certificate hasn't been renewed yet. I the same thing happened last year at this time. I had to enable password login for all of my users. I am probably going to add direct Google OAuth2 integration to avoid this issue. For WordPress sites, there is a free plug-ins that enable Google integration. For Nodejs based sites there are a couple of library's that do this, including the official Google library, and other library's that support multiple auth providers.

Alex_Camelio

When will someone respond?! This is ridiculous. This is literally what we pay this service to do. Will we all be getting credited $$ because of this?

Ian_Lipliavyi

We should advise them to install it in the calendar - update the certificate!

Do they know about the existence of electronic calendars?

:-)

Zach_Armstrong

Looks like its fixed all

Ivan_Gavrilov

Certificate for *.api.oneall.com updated.
From Tue, 05 Aug 2025 00:00:00 GMT.