3

User is able to connect to the website from work, but when they go home the same device fails to establish a secure connection to the site. User brings the same device to their parents house with a 3rd ISP and it works fine from there, only on their home connection does it fail to load the site. Multiple users (but not all) with this same ISP (Comcast) report being unable to load the site. All other secured websites load fine for said users though. Stage environment with identical code always loads fine. Only known differences are in the security certificates. Staging environment cert has a SHA1RSA signing algorithm, production environment cert has a SHA256RSA signing algorithm.

Firefox Error Page:

Secure Connection Failed The connection to the server was reset while the page was loading. The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.

IE Error Page:

This page can't be displayed Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced Settings. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4.

Chrome:

Displays the page sometimes, other times says page cannot be reached. In some cases, using Chrome does not work but InCognito mode does. InPrivate mode with IE does not work.

Things tried:

  • Wifi or ethernet, no change.
  • IE/Firefox, clear SSL Cache, clear history, deep refresh, no change.
  • Tried every combination of enabling/disabling SSL and TLS versions in IE, no change.
  • Same ISP/connection with different devices and operating system combos all fail to connect to the site, even if they have never visited it before.
  • Connection settings (not router settings), switch from Comcast's DNS to OpenDNS and also Google's DNS, then ipconfig /flushdns in CMD, no change.
  • ssllabs ssl test, certificates pass cleanly
  • http://dnsviz.net/, DNSSEC passes cleanly.
  • https://www.webpagetest.org/, website always loads successfully with every device/location/browser/connection combo (ISPs not specified there).

The problem makes no sense. If it was some sort of SSL caching problem, then virgin devices that have never touched the site would work, but they don't. And clearing the SSL cache would work, but it doesn't. If it's a internet connection problem, other sites besides this one would fail, but they all work fine. If it's a Comcast DNS issue and Chrome sometimes works because it uses Google's DNS secretly, then specifying in the connection settings to use OpenDNS or Google's DNS and flushing the DNS cache should have worked, but it didn't.

What else could it be? I've spent three weeks on his and can't think of anything else to try.

3
  • What does Comcast say?
    – user565955
    Commented Oct 3, 2016 at 14:33
  • Firefox and Chrome/IE/Edge use different certificate stores. This means if a problem exists with Firefox and Chrome/IE/Edge then something about your internet connection is to blame. Please format your question so its easier to read.
    – Ramhound
    Commented Oct 3, 2016 at 14:59
  • Comcast didn't know what to do. They suggested switching to minimum security in the router or disabling the router firewall altogether to see if that helped. I had already tried both (for both ipv4 and 6) and it did not work. It's multiple Comcast users reporting this problem, but not all Comcast users.
    – R. Lynch
    Commented Oct 3, 2016 at 15:31

2 Answers 2

3

Found the solution, adding it here in case anyone in the future has a similar problem.

The security certificate on the server was not bound to the IPv6 address, so when users with ISPs that had IPv6 enabled tried to connect, they would get a security error, while users on ISPs still only on IPv4 would connect fine.

0

Request a new lease in your internet settingsenter image description here

That should sort you out

If you got a new box, Then go and setup in your xfinity/Comcast control center

If on different device or would like a full walk through Do a google image search “renew lease Wifi “

https://www.google.com/search?q=renew+lease+wifi&rlz=1CDGOYI_enUS719US719&hl=en-US&prmd=snvi&source=lnms&tbm=isch&sa=X&ved=2ahUKEwiLyY6Q9svkAhXEvJ4KHa0dB9gQ_AUoBHoECBEQBA&biw=375&bih=638

This may not be the official solution. But that’s what worked for me. For a more technical solution, see the answer about ipv4,ipv6,ssl & ISPs —by R.Lynch

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .