Ask Your Question
0

How to capture HTTPS traffic with v3.0.2?

asked 2019-06-07 23:49:30 +0000

username gravatar image

updated 2019-06-07 23:57:07 +0000

Hello, I'm trying to figure out how to capture Chrome HTTPS traffic at Windows 7 with Wireshark and have already read tons of manuals and guides. But still, my Wireshark v.3.0.2 does not decrypt TLSv1.2 traffic. Here is what I do:

  • set environmental variable SSLKEYLOGFILE

  • start Chrome with --ssl-key-log-file="...path..." key

  • in Wireshark, set Edit -> Preferences -> Protocols -> TLS -> "(Pre)-Master-Secret log filename" to the same as in both lines above

  • starting capture

According to most guides, this should be enough.

Yet, still no decrypted data being showed at capture log. I'm still getting that "Encrypted Application Data" and no additional tabs showing below. There is no "SSL" protocol in Preferences as well, but most guides references to it so I'm being confused a lot if I doing something wrong. Still, can't get any clue not in google, nor here.

Checked it at various sites, even at httpbin.org, was trying to start capture first, browser first, rebooting, etc - still the same result, no HTTPS traffic decryption.

Chrome make it's secret log file perfectly and seem to be writing it correctly.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2019-06-10 17:12:11 +0000

grahamb gravatar image

updated 2019-06-10 17:12:37 +0000

The preference (and the associated dissector) has been renamed in Wireshark 3.0 and later to "TLS", because no-one is actually using SSL these days. Unfortunately those guides haven't caught up.

edit flag offensive delete link more
0

answered 2019-06-10 17:39:36 +0000

Lekensteyn gravatar image

If you can absolutely not decrypt any traffic even if the key log file is correctly written and configured in Wireshark, my guess is that you have some kind of anti-virus software running that basically terminates your TLS connection and creates a new connection.

If that is the case, you should be able to observe Certificate messages that are not signed by a trusted Certificate Authority (CA).

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2019-06-07 23:49:30 +0000

Seen: 3,060 times

Last updated: Jun 10