Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2025-05-12 05:33:58 +0000

SYN-bit gravatar image

Without any information to go on besides "Dycryption for my local site does not work" and "decryption for some other sides does work" it is not possible to determine the reason why.

There are two major reasons for decryption to fail:

  • There was a browser window still open, so it did not take the SSLKEYLOGFILE variable (this does not seem to be your case, as you can decrypt some sites, but I'm not sure they were tried in the same session)

    • There was TLS session resumption, in which case the keying information needed to construct the TLS session keys with the logged pre-master secrets was not captured.

Is the random number in the ClientHello towards your server listed in the SSLKEYLOGFILE? If not, there is something going wring in the collection of the pre-master secrets. If it is there, which cipher is chosen in the ServerHello? Do you see the full TLS handshake or a resumed one?

Can you make an example packet capture of a page on your server that is not privacy sensitive and share the pcap and keys file (on a public file share service like dropbox, onedrive, etc)?

Without any information to go on besides "Dycryption for my local site does not work" and "decryption for some other sides does work" it is not possible to determine the reason why.

There are two major reasons for decryption to fail:

  • There was a browser window still open, so it did not take the SSLKEYLOGFILE variable (this does not seem to be your case, as you can decrypt some sites, but I'm not sure they were tried in the same session)

      session)
    • There was TLS session resumption, in which case the keying information needed to construct the TLS session keys with the logged pre-master secrets was not captured.

Is the random number in the ClientHello towards your server listed in the SSLKEYLOGFILE? If not, there is something going wring in the collection of the pre-master secrets. If it is there, which cipher is chosen in the ServerHello? Do you see the full TLS handshake or a resumed one?

Can you make an example packet capture of a page on your server that is not privacy sensitive and share the pcap and keys file (on a public file share service like dropbox, onedrive, etc)?