SSL error when posting a link to a website with broken HTTPS link in meta og:image

Description:

I just posted a link to https://www.smore.com/clippy-js into a Rockat.Chat channel. This caused a "Do you trust certificate from "DigiCert Baltimore CA-2 G2"?" error popup:

The cause of this error is this meta tag on the website:

    <meta property="og:image" content="https://clippy.js.s3.amazonaws.com/og.jpg"/>

The SSL certificate covers only *.s3.amazonaws.com, so clippy.js.s3.amazonaws.com is not covered.

Rocket.Chat should IMO only log errors like these in the console, and not load the preview image.

Server Setup Information:

• Version of Rocket.Chat Server: 0.60.3
• Operating System: Debian stretch
• Deployment Method(snap/docker/tar/etc): tar
• Number of Running Instances: 1
• DB Replicaset Oplog: Disabled
• Node Version: v8.9.3

Steps to Reproduce:

1. Post a link to https://www.smore.com/clippy-js in a Rocket.Chat channel

Expected behavior:

No image should be loaded, no popup error message should be displayed.

Actual behavior:

An error message is displayed in a popup.

Start by reproducing the link-preview request for https://www.smore.com/clippy-js and inspect handling of its og:image URL, https://clippy.js.s3.amazonaws.com/og.jpg. Confirm that the invalid certificate is handled without a popup and that the preview image is not loaded; the payload names no source file or test to run.