Ah - I thought you wanted to completely replicate the login, given the securid secret.

If your problem is "only" with replicating the communication and not with some Javascript involved in the browser, the difference must be in the data that gets sent. If all headers are equal (except for the timestamps, and session cookies), then the difference must be in the payload data.

I don't know if SSL certificates get triggered by the URL or only by the host. If they get triggered by the URL, you will have to look into how LWP::UserAgent chooses the fitting certificate(s) to verify that the correct one is chosen..