间歇性SSL握手失败，无法访问Fastly CDN托管网站求助

我家里有个小型局域网，之前一直用虚拟机跑Pi-Hole做DNS服务。前几天虚拟机所在的机器因为硬盘故障挂了，我临时把我的UDM SE路由器DNS改成了8.8.8.8和8.8.4.4。从那之后，访问Fastly托管的网站（比如Reddit、XKCD，甚至Stack Exchange本身）就一直出问题——偶尔能正常打开（不然我也没法在这提问了），但大多数时候要么图片等资源加载不出来，要么直接弹出ERR_CONNECTION_RESET错误。

我完全搞不懂为啥会这样，而且偏偏只影响Fastly的站点。我已经清空了所有设备的DNS缓存，还试过让设备手动指定8.8.8.8或1.1.1.1绕开路由器DNS，但都没效果。所有设备都有这个问题，不是单台机器的故障，重启整个网络设备也没能解决。

后来我修复了虚拟机，把Pi-Hole恢复到故障前一模一样的配置，问题还是存在。查日志显示DNS请求都正常处理了，ping和tracert这些受影响的网站也没毛病，但就是没法在浏览器里稳定打开它们。

下面是我按照建议用各种程序测试这些站点的结果：

• Google Chrome：直接报错ERR_CONNECTION_RESET。开启详细日志后，反复出现以下错误：

  [21228:30708:0618/021007.153:ERROR:ssl_client_socket_impl.cc(978)] handshake failed; returned -1, SSL error code 1, net_error -101
  

• 带忽略证书错误参数的Google Chrome：--ignore-certificate-errors-spki-list不被识别为有效命令行参数；尝试用--ignore-certificate-error和--ignore-ssl-errors也没改变情况，日志里还是出现这些错误：

  PS C:\Program Files (x86)\Google\Chrome\Application> .\chrome.exe --enable-logging --v=1 --ignore-certificate-error --ignore-ssl-errors
  
  PS C:\Program Files (x86)\Google\Chrome\Application> [17988:23136:0618/141158.044:ERROR:ssl_client_socket_impl.cc(978)] handshake failed; returned -1, SSL error code 1, net_error -101
  
  [17988:23136:0618/141158.069:ERROR:ssl_client_socket_impl.cc(978)] handshake failed; returned -1, SSL error code 1, net_error -101
  
  [20400:25424:0618/141158.266:ERROR:cert_issuer_source_aia.cc(34)] Error parsing cert retrieved from AIA (as DER):
  ERROR: Couldn't read tbsCertificate as SEQUENCE
  ERROR: Failed parsing Certificate
  
  [20400:28820:0618/141159.529:ERROR:device_event_log_impl.cc(222)] [14:11:59.529] USB: usb_service_win.cc:415 Could not read device interface GUIDs: The system cannot find the file specified. (0x2)
  
  [17988:23136:0618/141200.144:ERROR:ssl_client_socket_impl.cc(978)] handshake failed; returned -1, SSL error code 1, net_error -101
  
  [20400:25424:0618/141200.307:ERROR:cert_issuer_source_aia.cc(34)] Error parsing cert retrieved from AIA (as DER):
  ERROR: Couldn't read tbsCertificate as SEQUENCE
  ERROR: Failed parsing Certificate
  
  [17988:23136:0618/141207.398:ERROR:ssl_client_socket_impl.cc(978)] handshake failed; returned -1, SSL error code 1, net_error -101
  

• iOS Safari：弹出提示“Safari can't open the page because it couldn't establish a secure connection to the server.”

• Firefox：静默加载失败。开启控制台日志后显示GET请求没有收到任何响应。

• curl：分别用IPv4和IPv6测试，得到以下错误输出：
  IPv4测试：

  curl -v -4 www.reddit.com
  * trying 151.101.1.140:80...
  * Connected to www.reddit.com (151.101.1.140) port 80 (#0)
  > GET / HTTP/1.1
  > Host: www.reddit.com
  > User-Agent: curl/7.81.0
  > Accept: */*
  >
  * Recv failure: Connection reset by peer
  * Closing connection 0
  curl: (56) Recv failure: Connection reset by peer
  

  IPv6测试：

  curl -v -6 www.reddit.com
  * Closing connection 0
  curl: (7) Couldn't connect to server
  

备注：内容来源于stack exchange，提问作者Areku