Failing Security Check with Authorize.net (AIM)

My SSL certificate is now in place. I have gone back and made all the recommended security changes mentioned on the forum, and now I should be ready to go live. I then signed up with an account from Authorize.net (AIM). Once I activate the SSL and use "https" I can check out fine until final authorization of the credit card. Rather than showing checkout success, it shows me the following:

"Security Check
We have detected that your browser has generated a different SSL Session ID than was used throughout our secure pages.
Privacy and Security
We validate the SSL Session ID automatically generated by your browser on every secure page request made to this server.

This validation assures that it is you who is navigating on this site with your account and not somebody else.

For security reasons, you will need to logon to your account again to continue shopping online.

Some browsers, such as Konqueror 3.1, do not have the capability to generate the required secure SSL Session ID automatically. If you use such a browser, we recommend switching to another browser to continue your online shopping with us. If you do not have another browser installed on your computer you can download a compatible one from: Microsoft Internet Explorer, Netscape, or Mozilla.

We have taken this security measure for your benefit, and apologize for any inconvenience it causes.

Please contact the store owner if you have any questions relating to this requirement, or to continue purchasing products offline"

I am checking out with Mozilla, so there should not have been a problem.

One solution that I can think might work is that I left the security patch items installed rather than removing them after completing the install. However, I am not sure if there is something else that I should look at first. Rather than try things at random (because this deals with security) I though I would ask the experts. Does anyone know what I should do to fix this?

beilana:

One solution that I can think might work is that I left the security patch items installed rather than removing them after completing the install.
Why would you think you should remove files that are intended to provide the required security protection?
DO NOT remove the security patch files until you upgrade to at least v1.3.9 or higher (after it is released).

beilana:

Security Check
We have detected that your browser has generated a different SSL Session ID than was used throughout our secure pages.
Privacy and Security
We validate the SSL Session ID automatically generated by your browser on every secure page request made to this server.

What are the settings in Admin->Configuration->Sessions set to?
Is there any particular reason why you changed them to something different than the default settings?

You probably have "Check SSL Session ID" set to "True" when it should normally be set to "False" unless you have a very specific intentional reason for changing it.

Thank you again DrByte.

Here they are...

Session Directory /home/finefitt/public_html/benjamin/cache
Cookie Domain True
Force Cookie Use False
Check SSL Session ID True
Check User Agent False
Check IP Address False
Prevent Spider Sessions True
Recreate Session True
IP to Host Conversion Status true

You are a genius DrByte.

I changed the Check SSL Session ID to "false" and everything worked just fine.

I will be sending a "round of coffees" for the group in a bit.

Thanks again.

Beilana

I always forget my Paypal account ID.

I will send the business check to your address.