ERR_SSL_BAD_RECORD_MAC_ALERT: Causes & Fix

• Antivirus/firewall with TLS inspection corrupts data
• A broken proxy between client and server
• Wrong MTU on the path (fragmentation mangles packets)
• Faulty RAM on the server (rare, but happens)
• Aggressive TCP offload on the NIC mangles packets
• Client: outdated OpenSSL with an AES-GCM bug

1. Temporarily disable the antivirus (Kaspersky/Bitdefender) — did the error go away?
2. Check MTU: ping -M do -s 1472 8.8.8.8; if fragments — lower to 1400
3. On the server: ethtool -K eth0 tso off gso off gro off (disable offload)
4. Update OpenSSL on both client and server to 3.x
5. Monitor uptime via Enterno Monitor — see failure patterns

Check SSL Certificate →

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_stapling        on;
    ssl_stapling_verify on;
}

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_CERT_DATE_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors

The ERR_SSL_BAD_RECORD_MAC_ALERT error indicates a corrupted TLS record, typically due to issues with the SSL/TLS handshake process. This can result from misconfigured server settings, outdated cryptographic protocols, or client-side errors. Resolving this error involves ensuring that both the server and client support the same TLS version, verifying certificate integrity, and checking for potential network interference.

The ERR_SSL_BAD_RECORD_MAC_ALERT error can arise from various factors that compromise the integrity of the TLS record. Understanding these causes is essential for effective troubleshooting.

• Misconfigured Server Settings: Incorrect SSL/TLS configurations on the server can lead to handshake failures. For example, if the server is set to use deprecated protocols like SSL 2.0 or SSL 3.0, modern clients may reject the connection.
• Outdated Cryptographic Protocols: Using outdated cipher suites can also trigger this error. Ensure that your server supports modern ciphers, such as those defined in RFC 8446 for TLS 1.3.
• Client-Side Errors: Corrupted browser caches or misconfigured client settings can result in this error. Clearing the browser cache or resetting network settings can often resolve the issue.
• Network Interference: Sometimes, firewalls or proxies may interfere with the SSL/TLS handshake, causing corrupted records. Check if any security appliances are inspecting or altering the traffic.

To resolve the ERR_SSL_BAD_RECORD_MAC_ALERT error, follow these practical troubleshooting steps:

1. Check Server Configuration: Review the server's SSL/TLS configuration. If you are using Apache, for example, you can verify the configuration in the httpd.conf or ssl.conf files. Ensure that the following directives are correctly set:

SSLEngine on
SSLCertificateFile /path/to/certificate.crt
SSLCertificateKeyFile /path/to/private.key
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:!aNULL:!MD5

1. Update SSL/TLS Libraries: Ensure that your server is running the latest version of OpenSSL or similar libraries. You can check the version with:

openssl version

1. Verify Certificate Integrity: Use the following command to check the certificate for errors:

openssl verify -CAfile /path/to/ca_bundle.crt /path/to/certificate.crt

1. Clear Browser Cache: If the error persists, clear the cache and cookies in your web browser. In Chrome, go to Settings > Privacy and Security > Clear Browsing Data.
2. Test with Different Browsers: Try accessing the site using different web browsers to rule out browser-specific issues.
3. Monitor Network Traffic: Use tools like Wireshark to capture and analyze network traffic. Look for anomalies during the SSL handshake process.

By systematically checking these areas, you can identify the root cause of the ERR_SSL_BAD_RECORD_MAC_ALERT error and implement the appropriate fixes.