how to setup wireshark to decrypt TLS SIP
First time setting up wireshark to decrypted TLS SIP messages.
Asked: 2019-04-10 15:26:17 +0000
Seen: 2,858 times
Last updated: Apr 10 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
You may or may not be able to decrypt TLS depending on what you have access to. What devices/interfaces are under your control and can you take packet captures on?
Have access to all devices/instruments along with their certs. In this particular case the call flow is from PC soft client-->call manager-->IP phone. However, for security reason I will not be able to upload a wireshark capture
There is a Wiki page on SSL here, depending on the key exchange algorithm chosen just having the certificate private keys may not be enough.
It also depends on whether this in TLS 1.2 or 1.3. You should be able to decrypt TLS 1.2 if you have access to the client or server (different methods for each). On TLS 1.3, it's possible to run into a confirmed bug.
I suspect that an IP Phone won't be running TLS 1.3 yet.