This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Does anyone know how to decrypt two way SSL connections?

0

Hi,

Does anyone know how to decrypt two way SSL connections? I have client and server private keys.

Thanks

asked 30 Sep '16, 13:23

Juniorr's gravatar image

Juniorr
6112
accept rate: 0%


2 Answers:

1

You can add the certificates under Edit | Preferences | Protocols | SSL . You need to capture the entire conversation - including the initial handshake. There is a great presentation that goes into detail about it:

https://www.wireshark.org/lists/wireshark-users/201001/msg00151.html

answered 14 Oct '16, 15:02

Keseymour's gravatar image

Keseymour
212
accept rate: 0%

0

In a TLS session with mutual authentication there are two certificates involved:

  • The server certificate.
  • The client certificate.

The server certificate is used for authentication and may (or may not) be used for key exchange. The client certificate is used for authentication only.

Practically speaking, if you only have only a private RSA key for the client, you cannot perform any decryption. If you have a private RSA key for the server and the server is agreeing on a RSA key exchange, you can configure the RSA private key at Preferences -> Protocols -> SSL -> RSA Keys list. Otherwise, if a Diffie-Hellman key exchange (instead of a RSA one) is in use, even posession of the RSA private key file will not allow you to decrypt the session (use the SSL Keylog file instead).

answered 16 Oct '16, 13:31

Lekensteyn's gravatar image

Lekensteyn
2.2k3724
accept rate: 30%