Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having a very weird problem when browsing a HTTPS site we host with Firefox.

I have no problem with most of the pages (we are using PHP/FreeBSD), but a few of them, when accessed with latest versions of Firefox (3.0.x), are randomly (not always) throwing this SSL error:

An error occurred during a connection to myserver.mydomain.com. SSL received a record with an incorrect Message Authentication Code. (Error code: ssl_error_bad_mac_read)

I don't know if it has something to do with the problem but my server has two NICs:

  • EXTERNAL_IP_ADDRESS (public IP)
  • INTERNAL_IP_ADDRESS (lan IP)

And I am seeing the error when accessing the page through the INTERNAL NIC.

I don't see the error with latest IE, Safari or Chrome.

My SSL certificate was issued by GoDaddy.

The strangest part of all is that whenever the error occurr, I can see the right page for a fraction of a second before Firefox shows me the error on a complete new page.

Thanks a lot.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

From Mozilla:

"SSL received a record with an incorrect Message Authentication Code."

This usually indicates that the client and server have failed to come to agreement on the set of keys used to encrypt the application data and to check message integrity. If this occurs frequently on a server, an active attack (such as the "million question" attack) may be underway against the server.

Another suggestion is to make sure the clock and timezone on the client and the server are correct. Maybe try synching to a time server.

share|improve this answer

If the page is visible before the error appears it usually means that the bad SSL connection is coming from something referenced in the page (stylesheet, image, etc) so you may want to investigate that first.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.