I recently finished to assemble my new PC and installed a Windows 10 Pro from the Microsoft utilitary tool.
All went fine, but suddenly, after like a week, errors began to pop in :
- On Firefox (latest stable version 73.0), queries over HTTPS is failing ~90% of the time
- On thick clients like Steam, Discord, some games launchers etc ... random services disconnection, or sometimes I have to start it multiple times before it can connect. Discord or Spotify, for instance, keep connect/disconnect 1 or 2 times per minuts...
- I also noticed a lot of ESENT errors message in the Windows Events Viewer : almost all of these are referencing bad checksum between images/db versions, corrupted WebCache database, segfault for writting logs, ... it's frequent and a lot of variations. (I can post these errors in details for those who ask)
The things I'm sure of :
- Not coming from something outside my PC : I tested on a shared 4G connection from my phone via USB, and the problems was still here.
- Tried a fresh Windows 10 new install again, and to remove latest Cumulative Updates
- BIOS and system clock , sync and OK
- Drivers up to date downloaded from the manufacturer website (Asus) on the motherboard page
- No local anti-virus or firewall is implied : I tried with all of these disabled (Windows defender, firewall, threat analysis,...)
My set up :
- Motherboard Asus ROG Strix z390-e Gaming
- CPU Intel Core CoffeeLake 9700k
- GPU Asus NVIDIA RTX2070 SUPER
- 2x8 Go Corsair RGB RAM (3200MHz)
- 2x 1 To Samsung 970Evo Plus M.2 SSD
I found a post similar to my issue : https://www.reddit.com/r/techsupport/comments/4396fz/windows_10_strange_tls_ssl_errors_very_stuck/
And tried several things to solve the ESENT errors in Windows Events Viewer : https://support.microsoft.com/fr-fr/help/278316/esent-event-ids-1000-1202-412-and-454-are-logged-repeatedly-in-the-app
Navigating through Microsoft forums, I tried to used tools like DISM or SFC to recover images integrity, so far, nothing was wrong according to these tools.
Tried chkdsk, nothing to report here too.
This evening, when home, I will try to boot on a Linux live USB key, and check if error persist.
I'll update this thread, to add later my Wireshark and process analysis ... and next discoveries ... thx
EDIT: I've opened a question on official Microsoft forum, and Added up to date details here Windows 10 ESENT 474 event corrupted local datafiles
EDIT2 : I made a breakthrough recently. I forced TLS 1.2 on Firefox and a lot of HTTPS website load now correctly. BUT YouTube and Google, and some others have still issues to load (BAD_MAC_READ). So I checked the cipher used to negociate client/server TLS connection :
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 on TLS1.2. The websites that correctly load on HTTPS with TLS1.2 are using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 instead of TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256.
I wanted to cross check with my game client launcher (League of Legends), so I started a Wireshark scan during client opening. And I see a very interesting exchange on TLS1.2 where the failing call is using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 Cipher ! I see my client correctly sending the Hello message (with available ciphers), then server respond with the cipher to use, and after that, server is sending a query of type : "new session ticket, change cipher spec". Then the client does not seems to respond to that, and the game client is missing some GUI parts. I'm pretty confident that the issue is related to the use of that cipher, but I dont know for sure.