Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Problem: I cannot connect to https://amps.dla.mil from my my office network. (Connection times out from all computers and different web browsers, no outbound firewall rules)

I can connect from my home network (though I do get SSL cert warnings)


Here's what I've tried:

HideMyAss.com Web Proxy: Works from my home network. Does NOT work from my office network

Free proxy from HidMyAss.com set in browser (204.12.223.170:3128): Does NOT work from my home OR office networks! (other HTTPS sites work fine)

tracert: tracert results are similar from both my home and office networks so the hostname is being resolved and the request is getting out onto the internet

Fiddler: Here is the raw request and response using Fiddler on a computer in my office network:

CONNECT amps.dla.mil:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:22.0) Gecko/20100101 Firefox/22.0 Connection: keep-alive Connection: keep-alive Host: amps.dla.mil

A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.

Version: 3.1 (TLS/1.0) Random: 51 E0 6B B7 22 DB 5B DA 03 EE 71 53 8A 33 5B 21 5E 27 F3 44 58 A8 B1 AD B2 48 F3 26 B8 DB 8A 7F SessionID: empty Extensions: server_name amps.dla.mil elliptic_curves 00 06 00 17 00 18 00 19 ec_point_formats 01 00 SessionTicket TLS empty NextProtocolNegotiation empty Ciphers: [00FF] TLS_EMPTY_RENEGOTIATION_INFO_SCSV [C00A] TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA [C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA [0088] TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA [0087] TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA [0039] TLS_DHE_RSA_WITH_AES_256_SHA [0038] TLS_DHE_DSS_WITH_AES_256_SHA [C00F] TLS_ECDH_RSA_WITH_AES_256_CBC_SHA [C005] TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA [0084] TLS_RSA_WITH_CAMELLIA_256_CBC_SHA [0035] TLS_RSA_AES_256_SHA [C007] TLS_ECDHE_ECDSA_WITH_RC4_128_SHA [C009] TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA [C011] TLS_ECDHE_RSA_WITH_RC4_128_SHA [C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA [0045] TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA [0044] TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA [0033] TLS_DHE_RSA_WITH_AES_128_SHA [0032] TLS_DHE_DSS_WITH_AES_128_SHA [C00C] TLS_ECDH_RSA_WITH_RC4_128_SHA [C00E] TLS_ECDH_RSA_WITH_AES_128_CBC_SHA [C002] TLS_ECDH_ECDSA_WITH_RC4_128_SHA [C004] TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA [0096] TLS_RSA_WITH_SEED_CBC_SHA [0041] TLS_RSA_WITH_CAMELLIA_128_CBC_SHA [0005] SSL_RSA_WITH_RC4_128_SHA [0004] SSL_RSA_WITH_RC4_128_MD5 [002F] TLS_RSA_AES_128_SHA [C008] TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA [C012] TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA [0016] SSL_DHE_RSA_WITH_3DES_EDE_SHA [0013] SSL_DHE_DSS_WITH_3DES_EDE_SHA [C00D] TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA [C003] TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA [FEFF] SSL_RSA_FIPS_WITH_3DES_EDE_SHA [000A] SSL_RSA_WITH_3DES_EDE_SHA

Compression: [00] NO_COMPRESSION

HTTP/1.1 200 Connection Established
    FiddlerGateway: Direct
    StartTime: 16:48:55.192
    Connection: close

    fiddler.network.https> Failed to secure existing connection for amps.dla.mil. Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. InnerException: System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
       at System.Net.Sockets.Socket.Receive(Byte[] buffer, Int32 offset, Int32 size, SocketFlags socketFlags)
       at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)

Is the website in question doing something strange? I don't understand why I can't access it from my home network through the above proxy.

How can I even go about troubleshooting this issue further? I figured the next step would be to call my ISP but I'd like to be able to intelligently explain what's going on.

share|improve this question
1  
I think that at your work you are using a VPN (Virtual Private Network) and the administrator at your work has set some rules. So this might be the problem. By the way the above link is not working for me too. –  Devid Jul 12 '13 at 20:53
    
@Devid I should have made it clear that I manage the network and server as my office! We don't use any VPNs or anything special like that. It's a very small office with only a few workstations and we just have a basic Netgear router with the default configuration. That's interesting that the site isn't working for you either. At least it's not just me! –  Lucifer Sam Jul 12 '13 at 21:01
add comment

2 Answers

I'm able to access the site without any issues. Your problem at work may be that you have a gateway/proxy that your network connection is going through. It caches data to help reduce the bandwidth of your network usage. Since you're getting an SSL Cert error, the gateway/proxy server is not able to pull the data and it is therefore rendering it as "down". You may want to get in touch with that site to see if they can get a new certificate or fix their issue. You also may want to touch base with your network team to see if they can put in an exclusion or configure the gateway to see if this will can be bypassed in these situations.

share|improve this answer
    
A proxy that's caching ssl connections? –  ott-- Jul 12 '13 at 21:15
    
Check out www.bluecoat.com is a commercial proxy that in fact CAN do https interception in order to block sites, restrict content, inspect for viruses and cache content (GETs) –  kobaltz Jul 12 '13 at 21:16
    
Thanks for the answer. I thought it might have something to do with a proxy server somewhere along the line since using the proxy sever made it so that I couldn't connect from my home network either. –  Lucifer Sam Jul 12 '13 at 21:20
    
So not only the NSA can intercept encrypted ssl-connections? –  ott-- Jul 12 '13 at 21:21
    
@ott-- lol who knows... –  kobaltz Jul 12 '13 at 21:22
add comment

I checked the above link https://amps.dla.mil and it seems that the website you are trying to reach is down. You can also check with this site: downforeveryoneorjustme.

I also have tried to ping the site but all the packets are lost.

share|improve this answer
    
The website is up, but if other people are having problems connecting I guess it could just be that their server is misconfigured somehow. –  Lucifer Sam Jul 12 '13 at 21:09
    
i see that @kobaltz can access the site, but the problem is not with the router, the problem is with the specific site. –  Devid Jul 12 '13 at 21:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.