问题
I'm having trouble accessing this website by automated script: https://mydtac.dtac.co.th/EserviceLogin/Login?page=N&lang=en
If i view from a browser (chrome, firefox, even lynx is working), it's all ok. I if try to load it from PHP (fsockopen), wget, or curl, it's complaining:
Warning: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac in
Also the openssl check fails:
openssl s_client -connect mydtac.dtac.co.th:443 3074164412:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:787:
I've tried on different systems (debian), both stable and testing release, and the problem is present everywhere with wget.
I've done a TCP dump on the connection, and it seems the way is different how the working and the failing methods are trying to initialize the ssl connection:
Failing request and response:
T 192.168.1.42:60748 -> 202.91.21.208:443 [AP] ....,...(..j...3O.....N[U.iv.).5'...P..2.......0.,.(.$.........k.j.9.8.....2...*.&.......=.5.../.+.'.#.........g.@.3.2.....E.D.1.-.).%...... .<./...A...............................................m...........4.2...................................................#..... ............ .........................
# T 202.91.21.208:443 -> 192.168.1.42:60748 [AP] ......(
Working request and response:
T 192.168.1.42:60751 -> 202.91.21.208:443 [AP] .................2...axg....;..|vYV....oS#..WD=u.zp..R./w...................3.2.E.9.8...../.A.5...........B.........mydtac.dtac.co.th...... ..................#..3t...........
# T 202.91.21.208:443 -> 192.168.1.42:60751 [AP] ....:...6..T ..(..ok.q..A....F?....k.>V....U..T.......^x.c...................0...0...............a..L.Gd....0....H........0f1.0...U....US1 .0...U....DigiCert Inc1.0...U....www.digicert.com1%0#..U....DigiCert High Assurance CA-30...120912000000Z..150917120000Z0..1.0...U....TH1.0. ..U....Bangkok1.0...U....Pathumwan1(0&..U....DTAC Internet Service Co., Ltd.1#0!..U....Enterprise Service Support1.0...U.....dtac.co.th0.." 0...*.H.............0.........sa.9.w..3.@I.K.....|...F...LgP.{J....b+.....:....".._.b.{c.....h...n.2.J...h..|lJ.=..^..i@6..^.Fgg.!s....U|..' ...w@.RU.>.... 3=cc.W......0U.......Jvlr....J.hb...p.+...d.}..A.. .;R..U.HN.\.#r%.%..F..X..;..Y&.......y....IUy>.....NU.-..$..i..I.P....... ...\c........N0..J0...U.#..0...P.s..)...... ..y.H..0...U.......-f.....U.Y.9;.....T0#..U....0...*.dtac.co.th..dtac.co.th0...U...........0...U .%..0...+.........+.......0a..U...Z0X0*.(.&.$http://crl3.digicert.com/ca3-g22.crl0*.(.&.$http://crl4.digicert.com/ca3-g22.crl0.....U. ....0. ..0......H...l..0...0:..+.........http://www.digicert.com/ssl-cps-repository.htm0..d..+.......0..V...R.A.n.y. .u.s.e. .o.f. .t.h.i.s. .C.e. r.t.i.f.i.c.a.t.e. .c.o.n.s.t.i.t.u.t.e.s. .a.c.c.e.p.t.a.n.c.e. .o.f. .t.h.e. .D.i.g.i.C.e.r.t. .C.P./.C.P.S. .a.n.d. .t.h.e. .R.e.l.y.i.n. g. .P.a.r.t.y. .A.g.r.e.e.m.e.n.t. .w.h.i.c.h. .l.i.m.i.t. .l.i.a.b.i.l.i.t.y. .a.n.d. .a.r.e. .i.n.c.o.r.p.o.r.a.t.e.d. .h.e.r.e.i.n. .b.y. .r.e.f.e.r.e.n.c.e..0{..+........o0m0$..+.....0
I'm trying to find a workaround this for 2 days but got stuck here. Any suggestions would be highly appreciated.
I know this is something which the webmaster should investigate, but that's not an option, as 99% of the people does not have any problem accessing these pages, they will do nothing for sure ...