Upcoming HTTPS Certificate Change
837 views
Skip to first unread message
Jeffrey Posnick
Nov 13, 2012, 10:41:49 AM11/13/12
to youtu...@googlegroups.com
If you’re a developer who uses the YouTube API, and if you make your requests to the API using HTTPS, there’s an upcoming change that you should be aware of. Sometime in early 2013, Google will be changing the certificates used for establishing secure HTTPS connections to all of our servers, in what we anticipate will be a backwards-compatible manner. Still, since there are so many slight differences in HTTPS client implementations, we encourage you to test your existing code in advance of this change and to report any issues that you do encounter.
To confirm compatability today in advance of the production change, you can make test API requests to stage.gdata.youtube.com and uploads.stage.gdata.youtube.com using version 1, 2, or 2.1 of the Data API, as described in this blog post about our staging environment. The new certificates are already in place on those servers. Be sure that you’re using https:// as the protocol.
If you’re using HTTP instead of HTTPS to access the YouTube Data API then you also won’t be affected by the new security certificates—but you really should start using HTTPS!
Developers who still rely on ClientLogin for handling authorization (which we also don’t recommend) have one additional thing to test, even if your actual YouTube API requests don’t use HTTPS: ClientLogin requests are made https://www.google.com/accounts/ClientLogin. Because we do not have a staging domain name set up for www.google.com, the recommended way of testing ClientLogin in advance of the certificate change is to hardcode the IP address 74.125.130.105 for the domain name www.google.com in the /etc/hosts file of your computer. Be sure to remove that entry when you’re done testing.
We don’t yet have a specific date in mind for making the switch in production, and when we do, it will be added as an update to this blog post. Please don’t wait until the last minute to test your code, though!
Cheers,
—Jeff Posnick, YouTube API Team
To confirm compatability today in advance of the production change, you can make test API requests to stage.gdata.youtube.com and uploads.stage.gdata.youtube.com using version 1, 2, or 2.1 of the Data API, as described in this blog post about our staging environment. The new certificates are already in place on those servers. Be sure that you’re using https:// as the protocol.
If you’re using HTTP instead of HTTPS to access the YouTube Data API then you also won’t be affected by the new security certificates—but you really should start using HTTPS!
Developers who still rely on ClientLogin for handling authorization (which we also don’t recommend) have one additional thing to test, even if your actual YouTube API requests don’t use HTTPS: ClientLogin requests are made https://www.google.com/accounts/ClientLogin. Because we do not have a staging domain name set up for www.google.com, the recommended way of testing ClientLogin in advance of the certificate change is to hardcode the IP address 74.125.130.105 for the domain name www.google.com in the /etc/hosts file of your computer. Be sure to remove that entry when you’re done testing.
We don’t yet have a specific date in mind for making the switch in production, and when we do, it will be added as an update to this blog post. Please don’t wait until the last minute to test your code, though!
Cheers,
—Jeff Posnick, YouTube API Team
Reply all
Reply to author
Forward
0 new messages