 | 1 | initial version |
Wireshark won't save the decrypted data, but you can export the session keys which are specific to the traffic in your capture file. After doing the decryption with the private key, go to file -> Export TLS Session Keys. Save the keys to a file. When you want to view the decrypted traffic again without the private key, point to the session keys file in the TLS protocol preferences under "(Pre)-Master-Secret log filename".
You can also add the keys to the pcap-ng file so that you do not have to point to a separate file by using editcap --inject-secrets tls,<file-with-exported-keys> <original.pcap> <new.pcap>
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
