I tried to understand a certificate issue and capturing using Wireshark to inspect the different sequences.
The case that is not working (wifi connection through my cable provider), I see:
- client Hello
- server Hello
- from again the server: Certificate, Server Key Exchange, server Hello Done
I'm able to see the certificate causing the issue (non valid).
Now the case that is working (same computer/browser), the only difference is the internet access through a LTE provider )
- client hello
- server hello, change cipher spec, Encrypted Handshake Message
- from the client change cipher spec, Encrypted Handshake Message
I'm not able to see the certificate on the capture (I assume it's because it's encrypted (Encrypted Handshake Message)
And as this is the case that is working, i'm able to see the website with a completely different valid certificate than the 1st non-working case.
My question is about the Encrypted Handshake Message, why this sequence is triggered and is there a way to see more what happens?
Could SSL inspection (on the router/firewall) be the root cause of this certificate change? And in this case the Encrypted Handshake is done between the website and the router?
The two captures are below. You can use the display filter to remove the noise
tcp.port eq 443 and ip.addr==220.127.116.11/24