Recently, we have found that our web page occassinally could not be opened. Then we have captured the data packets on both client side and server side and found a very strange phenomenon.
In a TLS communication process, client side sent "client hello" to server, then server replied with "server hello and certificate" and the client side acknowledged. But then the data packets captured on server side shows that the server side had sent "server key exchange and sever hello done" message which did not appear in data packets captured on client side. That could explain why our web page could not be opened as client side was waiting for "server hello done" message. However, in the data packets captured on server side, the "server key exchange" data packet was acknowledged by client side. I am very confused by this issue. Who did acknowledge the "server key exchange" packet? Is it something like a middle man attack?