Can I capture certificate and store it without implementing session key of both TLSv1.2 and TLSv1.3

asked 2025-11-12 06:06:37 +0000

Pihu
1

Can I capture certificate and store it without implementing session key of both TLSv1.2 and TLSv1.3 in Linux , I am trying to store TLS_Certificate details using pyshark but unable to do that , is their any other tools we should use or we can store using pyshark.

answered 2025-11-12 06:44:22 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23850 ●4 ●991 ●227 https://www.wireshark.org

With a recent version of tshark (4.6.x), you can export x509 certificates to files, how you handle them in pyshark is up to that separate project.

An example:

tshark -r <path\to\capture\file> -export-objects x509af,<path\to\destdir>

edit flag offensive delete link

Comments

T add to that, please note that the certificate is sent in the unencrypted phase of the handshake in TLSv1.2 and it is sent in the encrypted phase of the handshake in TLSv1.3. This means you will only see the certificates sent in a TLSv1.2 connection if you do not provide the TLS session keys.

SYN-bit ( 2025-11-12 08:48:24 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Can I capture certificate and store it without implementing session key of both TLSv1.2 and TLSv1.3

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Can I capture certificate and store it without implementing session key of both TLSv1.2 and TLSv1.3 edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Can I capture certificate and store it without implementing session key of both TLSv1.2 and TLSv1.3