[danceparty]

AT&T runs transparent proxies on their network that have been known to intercept and mangle tls, and directly manipulate tcp packets on the wire.

Take a tcpdump capture on both server/client side and compare the handshake/tcp headers/negotiated window size. Often you see the server sending one thing, but the client sees another

[hevisko]

question: could people confirm the ssl certificate chains being used by the server, and reported by the client?