I have a site published with Forefront TMG as HTTPS website. It has a valid SSL certificate (EV). The site displays correctly on all browsers except Safari, Midori and Dolphin.
The problem is on Safari there is no connection at all to the website. Like the site doesn't respond to the request at all. No file is transferred. The connection is completely dead. At least for a long time (30 seconds to a couple of minutes).
I have several different websites configured over HTTPS. Different domains, different IPs and different certificates. The certificates are from different issuers.
The problem exists with all my HTTPS websites, ONLY with Safari, Midori and Dolphin browsers, all 3 sites work correctly on every other browser. No lags, no problems reported.
I tried to disable HTTP to HTTPS redirection at TMG listener to rule out the certificate problem. I cannot access my websites over http too. They however perfectly accessible from Firefox, Opera, Chrome, IE, Vivaldi, Slimjet and Edge browsers.
Sometimes I can display a single page on Safari, but it takes over 30 seconds to show, but with some images (and / or CSS) missing. Then - the website fails because AJAX on the page fails, though the CORS headers are correctly configured and referenced URL-s can even respond (with huge lags).
It looks like this: you enter the URL and get a message about the site is inaccessible. Then if you refresh the page several times it finally appear, but badly broken (like many files were inaccessible).
On other browsers there are no lags. All files are accessible immediately.
In my Web Access Policy tab I have all the inspection and proxy options disabled.
What's the most weird of all - I have an other site (HTTP) on the same server, but published on different IP. The site works on ALL browsers without problems. All IPs and routing seems to be properly configured, and if they weren't, how would the other browsers display the sites?
BTW, it's 100% not on the websites themselves. Even if I try to open a single HTML file or an image from the site it cannot be fetched with Safari.
IMPORTANT: The site SSL certificate information is displayed correctly, this is the only thing which is downloaded from those sites. So I see the padlock icon, site information, but no content. After allowing HTTP connections it doesn't work either over HTTP. Works over HTTP on some browsers.
IMPORTANT: The mentioned sites are all accessible on all browsers when TMG is ommited (over VPN, when directly referencing my NLB IP).
The problem started when we moved our virtual servers to new hosts on new network. On the old network it all worked. But then again - what has internal network configuration to sites being inaccessible only on certain browsers?
Update
I've tried many things, like changing MTU on CISCO ASA firewall, but it didn't help. I tried to update my SSL configuration on TMG using this tutorial:
Improving SSL security on Forefront TMG
I ended with the test doesn't even complete. Plus I get a warning about "inconsistent server configuration". And it stops with "Long handshake workaround: hanshake not longer than 0x200 bytes: 132" message. Well, I have domain www.example.com and example.com set to different addresses. It's on purpose. And there is a couple of redirections between 2 of them. BTW, www site has its own certificate in case someone typed its URL with https. But it's mostly not used. And yes, I replaced the non-www server's certificate, but the www remain without update. It's an error, but it should affect only www site. But the one which is misbehaving is https://example.com, not https://www.example.com.
What is wrong? Since it worked well last time I had the same TMG VM on different host. I had my sites on different (older) IIS servers. I had different external IPs and no DMZ. And the certificate was different, older, with 128bit key instead of 256. There was no CISCO ASA firewall. After we moved all websites to new machines it happened. They work on any browser except Safari, Midori and Dolphin.
Update
I'm connected to internal network via VPN, via ASA. If I set my site domain IP straight to internal NLB address - it works. If I set to DMZ IP - it doesn't. And of course on external IP - it doesn't. Of course - all 3 paths work perfectly on most browsers, only Safari, Midori and Dolphin are affected.
BTW, the very same CISCO ASA routes my web requests to public network.
BTW2: Pure HTTP site (no certificate) from the very same IIS->NLB->TMG->DMZ->ASA - works with Safari with no lags or other problems. The only thing I haven't tested was removing certificate and setting HTTP access only. It's a production website, if I would go for it, I should do it at night and in a huge hurry.