Windows 10 TLS/SSL weird issues (BAD_MAC_READ, programs queries interupted, ...)

Question

I recently finished to assemble my new PC and installed a Windows 10 Pro from the Microsoft utilitary tool.

All went fine, but suddenly, after like a week, errors began to pop in :

• On Firefox (latest stable version 73.0), queries over HTTPS is failing ~90% of the time
• On thick clients like Steam, Discord, some games launchers etc ... random services disconnection, or sometimes I have to start it multiple times before it can connect. Discord or Spotify, for instance, keep connect/disconnect 1 or 2 times per minuts...
• I also noticed a lot of ESENT errors message in the Windows Events Viewer : almost all of these are referencing bad checksum between images/db versions, corrupted WebCache database, segfault for writting logs, ... it's frequent and a lot of variations. (I can post these errors in details for those who ask)

The things I'm sure of :

• Not coming from something outside my PC : I tested on a shared 4G connection from my phone via USB, and the problems was still here.
• Tried a fresh Windows 10 new install again, and to remove latest Cumulative Updates
• BIOS and system clock , sync and OK
• Drivers up to date downloaded from the manufacturer website (Asus) on the motherboard page
• No local anti-virus or firewall is implied : I tried with all of these disabled (Windows defender, firewall, threat analysis,...)

My set up :

• Motherboard Asus ROG Strix z390-e Gaming
• CPU Intel Core CoffeeLake 9700k
• GPU Asus NVIDIA RTX2070 SUPER
• 2x8 Go Corsair RGB RAM (3200MHz)
• 2x 1 To Samsung 970Evo Plus M.2 SSD

I found a post similar to my issue : https://www.reddit.com/r/techsupport/comments/4396fz/windows_10_strange_tls_ssl_errors_very_stuck/

And tried several things to solve the ESENT errors in Windows Events Viewer : https://support.microsoft.com/fr-fr/help/278316/esent-event-ids-1000-1202-412-and-454-are-logged-repeatedly-in-the-app

Navigating through Microsoft forums, I tried to used tools like DISM or SFC to recover images integrity, so far, nothing was wrong according to these tools.

Tried chkdsk, nothing to report here too.

This evening, when home, I will try to boot on a Linux live USB key, and check if error persist.

I'll update this thread, to add later my Wireshark and process analysis ... and next discoveries ... thx

EDIT: I've opened a question on official Microsoft forum, and Added up to date details here Windows 10 ESENT 474 event corrupted local datafiles

EDIT2 : I made a breakthrough recently. I forced TLS 1.2 on Firefox and a lot of HTTPS website load now correctly. BUT YouTube and Google, and some others have still issues to load (BAD_MAC_READ). So I checked the cipher used to negociate client/server TLS connection :

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 on TLS1.2. The websites that correctly load on HTTPS with TLS1.2 are using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 instead of TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256.

I wanted to cross check with my game client launcher (League of Legends), so I started a Wireshark scan during client opening. And I see a very interesting exchange on TLS1.2 where the failing call is using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 Cipher ! I see my client correctly sending the Hello message (with available ciphers), then server respond with the cipher to use, and after that, server is sending a query of type : "new session ticket, change cipher spec". Then the client does not seems to respond to that, and the game client is missing some GUI parts. I'm pretty confident that the issue is related to the use of that cipher, but I dont know for sure.

Answer 1

I finally found the culprit here. Need to determine if it's CPU driver/chipset fault or CPU fault but :

I ran an Intel Diagnostic Tool scan, and the CPU tests failed here :

So in order to test if core were faulty, I ran 'msconfig' to try to disabled 4 CPU cores out of the 8 available.

I reboot and guess what ? The encryption messages have now no problems ! I can start all my apps, all queries succeeds on all browsers ! The CPU is brand new, and I took extra care when puting it in socket, and locking it. Same for ventirad and thermal paste, I checked, Nothing visually seems wrong :(

I really hope I will not have to return it because I know what kind of magic trick can happens when sending back a so fragile component (excuses given at reception : some pins were twisted, you broke it !).

Answer 2

Encountered roughly the same error as OP. Websites loaded intermittently, sometimes with different SSL error codes. Firefox gives a bit more detailed errors compared to Chrome; the errors alternated between bad MAC read and bad MAC alert.

Tried reinstalling Windows 10, Ethernet instead of wifi and Linux instead of Windows. Same errors. CPU test in Intel Diagnostic Tool didn't show any errors.

Reading the tip about Process Lasso made me test it. After testing different combinations of CPU (core) affinities I realized having the web browser use core 6-7 led to the errors. I haven't gotten a single error since using Process Lasso for a day now. CPU is an i7-6700, approx. 8 years old by now, so no big deal losing a couple of cores for daily usage.

The error was for sure frustrating but in hindsight pretty fun to troubleshoot and solve ;)