Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. In the past we have seen errors from Facebook, Barnes and Noble, and others. It also seems to be network-wide; my desktop, phone, and wife's phone have SSL problems as well when we're connected to the network.

I'm not a security expert, so I have a few off-the-wall guesses as to why this could be happening:

  1. The DNS server we're using is unreliable. My router's DHCP settings uses Google's DNS service, so I doubt it.
  2. Someone is actually trying to do a man-in-the-middle attack. That seems unlikely to me, especially since the bad certificates I see claim to be from Apple, Akamai, etc.
  3. My ISP is having routing problems.
  4. All these sites I'm randomly having problems with are actually misconfigured, and I need to wait for their system administrators to fix the problem.

What are the most common causes for these errors? Where do you start to diagnose these errors?

  • Could you include what browsers you're using, as it's not unheard of that browsers themselves cause certificate related problems. If you could also include some URLs where you're experiencing problems, that'd be great too, thanks!
    – TildalWave
    Commented Mar 30, 2013 at 13:39
  • This happens on all our browsers - mobile Safari, Windows Phone's Internet Explorer, Chrome, and Firefox. I don't know/remember all the specific URLs, but it happens with google.com, facebook login, etc. It seems pretty random, happens about once per week.
    – Phil
    Commented Mar 30, 2013 at 13:55
  • 1
    @TildalWave I would also like to point out that this question is not a "How do I fix my problem" question, but more of a "What steps do I need to take to diagnose this problem" kind of question. If knowing the specific URL is a really important step, please feel free to include that in an answer.
    – Phil
    Commented Mar 30, 2013 at 14:17

3 Answers 3


In SSL, things go like that: the client looks up the server name in the DNS; then it connects to the IP address the DNS came up with; then the SSL handshake occurs, during which the server sends its certificate. Note that the actual URL has not been sent anywhere at that point, only the server name; so we can ignore the URL for the diagnosis.

Since the problem impacts several machines with distinct OS and browsers, we can probably rule out browser and OS bugs.

Google, Barnes and Noble, Facebook... are human creation which, as such, are imperfect and may fail occasionally; but it is quite improbable that they all fail simultaneously.

If you are the target of a Man-in-the-Middle attack, then the attacker is singularly incompetent. That's quite improbable too.

To sum up, the problem is probably somewhere between your router and your ISP. The symptoms you observe are coherent with the hypothesis that the TCP connection from your browser, formerly directed at www.google.com, ends up on Apple's iCloud servers. A first potential scenario is the following:

Your router is a DNS relay. Over DHCP, it actually configures your home machines to use the router as DNS server, and that router will feed on the external DNS server you configured (Google's DNS server). In that case, if the router mixes its internal tables (due to a software bug or bad RAM), then it may gives wrong IP addresses to your machines.

In that scenario, the problem is not limited to SSL. Indeed, when the browser wants to connect to any server, it asks for the server name but not for the port or protocol. Therefore, if that hypothesis is correct, then non-SSL, plain HTTP connections should also occasionally fail. For instance, if your connection to www.facebook.com is redirected to the IP address of www.google.com, you will get a Google answer (actually a redirect to Google's main page), and nothing Facebook-like.

If only your SSL connections have trouble, then this is not a DNS issue. This would point to a second potential scenario:

Your ISP has some problem with its dynamic routing. It tries to route traffic optimally, moving packets between several destinations. These routing decision can be port-specific, thus explaining why the problem occurs with SSL only. For some reason (possibly bad RAM again, in one of the ISP routers), packets can get misdirected.

I have known an old Cisco router (with bad RAM) which behaved a bit like that. When a router processes an IP packet, it must copy and partially modify the header (at least to modify the TTL) so bugs in the router can result in destination address being mangled.

This scenario has a variant in which your router has bad RAM (again...) and trips on its own feet when doing NAT.

To further diagnose the problem:

  • When the problem occurs, from the same machine, do a nslookup www.google.com (if you wanted to contact Google but was redirected somewhere else) then openssl s_client -connect www.google.com:443 (using the OpenSSL command line tool -- if you use Linux or MacOS X, then you already have it). This will tell you what IP address is returned by the DNS, and what certificate is returned by the server which purportedly answers at that address.

  • If the problem is intermittent (i.e. the browser connection fails, but trying again immediately works), try running a network capture tool like Wireshark or Network Monitor to observe exactly what went on when the problem occurred. You will see the IP addresses as seen from your machine.

  • Change your home router. For instance, borrow an old router from a friend, or buy a new one (these cost 40$). If the problem is at your ISP, then the ISP support staff will probably first claim that your router is at fault, so this step cannot really be avoided anyway. If changing the router removes the issue, then you know that bad RAM stroke once again.

  • High-volume sites like google and facebook have hundreds or thousands of webservers, and often distribute traffic at least partly by having DNS give different addresses to different clients; if one server is misconfigured you may hit the error only 1% or whatever of the time seemingly at random. This gives the same effect and is diagnosed much the same way as the DNS or routing bugs described except it's a mistake not a bug. Commented Aug 31, 2014 at 9:51

Many people are seeing akamai and voice5 certificate errors lately. This is because the cloud is handling the relay of their certificates and the names will not match unless your DNS updates very rapidly. Also, many ISPs like Optimum will cache data on local servers which may also break things. Most Windows DNS servers and Windows workstations will also cache the reverse and force a mismatch condition. Not a surprise, and another consequence of using the cloud for security. It's not you. It's that sad thing they call a cloud!


I wanted to add some extra info, because I had the exact same problem described by Phil, except, on some occasions I was actually being served what looked like a malicious webpage (regardless of browser). The webpage said things like:

(Chrome): "To continue your web surfing, please download and install this software. Microsoft System Tools 16.3846. This network tools designed for out customers only!"

How reassuring. I'm on a Macbook Pro by the way. The types of sites I was having issues with were: gmail, facebook, wikipedia, youtube.

Anyway, it was cross-browser, and seemed to be network-related (I didn't have the problem on other networks with the same computer). Nothing seemed to work to fix it, including clearing caches, reinstalling browsers, installing new browsers, running virus scans, whatever. There's not a lot of specific info on the net... a lot of it relates to checking your computer's date/time, which is definitely not the problem in this case.

I just reset my modem settings, and for the time being, that has solved the SSL errors. My IP address is still the same however, so I guess it's not an IP Spoofing issue?

Anyway, hopefully this helps others.



  • Erik I realize this is 4 years later, but for the record: 1: that's a similar-looking problem, not the exact same one, and therefore isn't an answer. 2: if resetting your modem fixed it, then your modem was probably infected, and still vulnerable to re-infection after the reset. It needs a manufacturer firmware update (or total replacement).
    – Foo Bar
    Commented Aug 22, 2018 at 20:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .