ERR_SSL_PROTOCOL_ERROR in Chrome. Who wedges into an SSL connection?

D

dimmaq2017-08-15 16:20:31

Digital certificates

dimmaq, 2017-08-15 16:20:31

I noticed that periodically when I go to the Amazon it gives out ERR_SSL_PROTOCOL_ERROR (I noticed only on the Amazon). It stops opening with this error for a few seconds, then it's normal again.
I caught the moment and saved the traffic with wireshark. Dump - https://yadi.sk/d/rdeZ2jS43M2qE7
There, after the browser sends a TLSv1 Client Hello, a response comes in plain text (see below HTTP / 1.1 409 Conflict)
Computer laptop with win10, antivirus from microsoft. The Internet goes through the router asus rtn16.
Google doesn't know about wguard-2. Doesn't look like an amazon bug.
Who could it be?
Answer:

HTTP/1.1 409 Conflict
Server: squid/3.5.25
Mime-Version: 1.0
Date: Tue, 15 Aug 2017 10:19:04 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 3682
X-Squid-Error: ERR_CONFLICT_HOST 0
Vary: Accept-Language
Content-Language: en
X-Cache: MISS from wguard-2
Via: 1.1 wguard-2 (squid/3.5.25)
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html><head>
<meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>ERROR: The requested URL could not be retrieved</title>
<style type="text/css"><!-- 
 /*
 * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
 */

/*
 Stylesheet for Squid Error pages
 Adapted from design by Free CSS Templates
 http://www.freecsstemplates.org
 Released for free under a Creative Commons Attribution 2.5 License
*/

/* Page basics */
* {
  font-family: verdana, sans-serif;
}

html body {
  margin: 0;
  padding: 0;
  background: #efefef;
  font-size: 12px;
  color: #1e1e1e;
}

/* Page displayed title area */
#titles {
  margin-left: 15px;
  padding: 10px;
  padding-left: 100px;
  background: url('/squid-internal-static/icons/SN.png') no-repeat left;
}

/* initial title */
#titles h1 {
  color: #000000;
}
#titles h2 {
  color: #000000;
}

/* special event: FTP success page titles */
#titles ftpsuccess {
  background-color:#00ff00;
  width:100%;
}

/* Page displayed body content area */
#content {
  padding: 10px;
  background: #ffffff;
}

/* General text */
p {
}

/* error brief description */
#error p {
}

/* some data which may have caused the problem */
#data {
}

/* the error message received from the system or other software */
#sysmsg {
}

pre {
    font-family:sans-serif;
}

/* special event: FTP / Gopher directory listing */
#dirmsg {
    font-family: courier;
    color: black;
    font-size: 10pt;
}
#dirlisting {
    margin-left: 2%;
    margin-right: 2%;
}
#dirlisting tr.entry td.icon,td.filename,td.size,td.date {
    border-bottom: groove;
}
#dirlisting td.size {
    width: 50px;
    text-align: right;
    padding-right: 5px;
}

/* horizontal lines */
hr {
  margin: 0;
}

/* page displayed footer area */
#footer {
  font-size: 9px;
  padding-left: 10px;
}


body
:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }
:lang(he) { direction: rtl; }
 --></style>
</head><body id=ERR_CONFLICT_HOST>
<div id="titles">
<h1>ERROR</h1>
<h2>The requested URL could not be retrieved</h2>
</div>
<hr>

<div id="content">
<p>The following error was encountered while trying to retrieve the URL: <a href="https://www.amazon.com/*">https://www.amazon.com/*</a></p>

<blockquote id="data">
<pre>URI Host Conflict</pre>
</blockquote>

<p>This means the domain name you are trying to access apparently no longer exists on the machine you are requesting it from.</p>

<p>Some possible problems are:</p>
<ul>
<li>The domain may have moved very recently. Trying again will resolve that.</li>
<li>The website may require you to use a local country-based version. Using your ISP provided DNS server(s) should resolve that.</li>
</ul>

<p>Your cache administrator is <a href="mailto:webmaster?subject=CacheErrorInfo%20-%20ERR_CONFLICT_HOST&amp;body=CacheHost%3A%20wguard-2%0D%0AErrPage%3A%20ERR_CONFLICT_HOST%0D%0AErr%3A%20%5Bnone%5D%0D%0ATimeStamp%3A%20Tue,%2015%20Aug%202017%2010%3A19%3A20%20GMT%0D%0A%0D%0AClientIP%3A%20xxxxxxx%0D%0A%0D%0AHTTP%20Request%3A%0D%0ACONNECT%20%2F%20HTTP%2F1.1%0AHost%3A%20www.amazon.com%3A443%0D%0A%0D%0A%0D%0A">webmaster</a>.</p>
<br>
</div>

<hr>
<div id="footer">
<p>Generated Tue, 15 Aug 2017 10:19:20 GMT by wguard-2 (squid/3.5.25)</p>
<!-- ERR_CONFLICT_HOST -->
</div>
</body></html>

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

G

g0nzo, 2017-10-15
@ g0nzo

There was something similar. Various sites on https did not open. The last one is greasyfork.org. In the response from the requested server, html code from squid. As I understand it, some providers use squid to block resources via https from the ILV registry, and perhaps they set up something crookedly, and this is the result.