We've identified a certificate-validation issue affecting VRChat's bundled yt-dlp when resolving HTTPS URLs served through Cloudflare Universal SSL using Let's Encrypt.

This does not appear to be an issue with an expired website certificate or an individual user's system configuration.

The affected Cloudflare certificate is currently valid:

Despite this, VRChat's bundled resolver fails with:

Reproducibility

The issue reproduces consistently when using VRChat's currently bundled yt-dlp:

The same HTTPS endpoints:

* Validate normally in modern browsers

* Validate normally through Windows curl.exe / Schannel

* Are served using a currently valid Cloudflare Universal SSL certificate

* Resolve successfully through alternative/custom yt-dlp integrations

* Consistently fail certificate validation through VRChat's bundled yt-dlp

This makes the problem appear to be an incompatibility between VRChat's bundled yt-dlp certificate-validation environment and the Let's Encrypt certificate chain currently being served by Cloudflare.

Isolating the failure

Using VRChat's own yt-dlp.exe, resolving an affected URL normally results in:

Running the exact same request with:

immediately succeeds and returns the expected media URL.

We are not suggesting disabling certificate validation as a workaround. This was used solely as an A/B diagnostic and confirms that certificate verification itself is the point of failure.

Why this may have wider impact

The affected hostname is not serving a manually configured or unusual certificate. It is using a standard Cloudflare Universal SSL certificate issued by Let's Encrypt.

Because Cloudflare deploys Universal SSL certificates across a very large number of domains, this may potentially affect other VRChat video services or websites whose Cloudflare edge certificate is issued through the same or a similar Let's Encrypt chain.

This therefore may not be limited to one video provider or one unusual URL configuration.

Expected behavior

Currently valid HTTPS certificates trusted by standard browsers and operating-system TLS implementations should also validate successfully through VRChat's video resolver.

Actual behavior

VRChat's bundled yt-dlp reports the Cloudflare-served Let's Encrypt certificate chain as expired and refuses to resolve the URL, despite the certificate itself currently being valid.

Temporary workaround

Alternative/custom yt-dlp integrations do not appear to exhibit the same issue and can currently resolve the affected URLs.

This is not an appropriate long-term solution for world authors or normal users, but it may provide a temporary workaround for users already running such tools.

Reproduction URLs

We would prefer not to publish affected production endpoints publicly.

We have confirmed URLs that reproduce the issue consistently and can provide them, along with certificate details and our testing results, privately to VRChat staff.

VRChat staff are welcome to contact us and we'll provide the affected URLs and full reproduction information privately.