Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2021-06-25 12:28:32 +0000

SYN-bit gravatar image

The ClientCertificate is spread over frames 10, 11 and 12. In order for Wireshark to display the certificate, it needs to reassemble those frames and then it will show the Certificate in frame 12. If you use the default Wireshark profile, this should work. If you use a custom profile, please make sure that:

  • Checksum checking is disabled in the IP and TCP protocol preferences
  • Reassembly is enabled in the TCP and the TLS protocol preferences

Tshark should give the following output for your current profile if all is set correctly:

$ tshark  -G currentprefs | egrep '^#?(ip|tcp|tls)\..*(checksum|desegment).*'
#ip.check_checksum: FALSE
#tcp.check_checksum: FALSE
#tcp.desegment_tcp_streams: TRUE
#tls.desegment_ssl_records: TRUE
#tls.desegment_ssl_application_data: TRUE
$