Ask Your Question

Revision history [back]

Tshark select end certificate only

Hey all,

I'm doing some research on certificate validity and therefore I'd like to export the Notbefore and Notafter (x509af.utcTime) and some other data using Tshark. Unfortunately this value exists multiple times in the certificate packet (End entity certificate - > Intermediate certificate -> Root certificate (chain of trust)).

I'm desperately looking for a filter variable where I can output this single certificate, without the intermediate and root one.

Thanks in advance!