Decrypt SSL with Wireshark – HTTPS Decryption: Step-by-Step Guide

Decrypt SSL with Wireshark

If you ’ ve ever tried using Wireshark to monitor web traffic, you ’ ve probably run into a problem – a bunch of it is code transmissions. In fact, most sites are using SSL or Transport Layer Security ( TLS ) encoding to keep their users safe .

omnipresent encoding is a good thing if you ’ ra denounce on Amazon, but it ’ s a veridical pain when you ’ re trying to administer a network. hera ’ s how I decrypt SSL with Wireshark .

In this post we cover:

What are Wireshark and SSL Encryption ?

Wireshark is a network traffic analyzer ; it ’ s a kernel utility that many administrators use to troubleshoot problems on their networks. specifically, it captures frames – the build up blocks of packets – and lets you sort through and analyze them.

Using Wireshark, you can look at the traffic flowing across your network and dissect it, getting a peek inside of frames at the raw data .
SSL is an encoding protocol that operates on the Transport level of the OSI mannequin. It uses assorted encoding methods to secure data as it moves across networks. note : In this guide, I ’ ll by and large be referring to SSL as a catchall term for SSL and TLS, its successor .
SSL encoding makes using Wireshark more challenging because it prevents administrators from viewing the data that each relevant packet carries. When Wireshark is set up by rights, it can decrypt SSL and restore your ability to view the raw data .
See besides : Wireshark Alternatives for package sniff

Using a pre-master secret key to decrypt SSL and TLS

Using a pre-master unavowed winder to decrypt SSL in Wireshark is the commend method acting .

A pre-master secret key is generated by the customer and used by the server to derive a master identify that encrypts the seance traffic. It ’ s the current standard in cryptanalysis and is normally implemented via Diffie-Hellman .

Your browser can be made to log the pre-master secret samara, which Wireshark uses to decrypt SSL and TLS sessions .
here are the steps to decrypting SSL and TLS with a pre-master hidden key :

  • Set an environment variable
  • Launch your browser
  • Configure Wireshark
  • Capture and decrypt the session keys

When you ’ re finished, you ’ ll be able to decrypt SSL and TLS sessions in Wireshark without needing access to the target server .

Set a Windows environment variable

In Windows systems, you ’ ll need to set an environment variable using the Advanced system settings utility. This variable, named SSLKEYLOGFILE, contains a way where the pre-master privy keys are stored .
Windows Properties
start by right-clicking on My Computer, and selecting Properties from the menu. The System menu will open .
Windows Control
following, snap Advanced system settings on the list to the left. The System Properties window will open .
Windows System
On the Advanced check, click the Environment Variables push button .
Environment Variables
Click the New… clitoris under User variables. You can besides create the variable under System variables if you ’ d like to log SSL keys for every exploiter on the arrangement, but I prefer to keep it confined to my visibility .
New user Variable
Under Variable name, type the follow :


In the Variable value field, type a path to the log file. You can besides click the Browse file… button and specify the path using the file picker .
As a note, if you ’ re creating this as a system-wide environment variable, you ’ ll want to use allow wildcards or store the file in a place accessible by all users. For exemplify, you might choose %USERPROFILE%\App Data\ssl-keys.log or C:\ssl-keys.log .
once you ’ ve finished, chink OK and move to the future hardening of steps .

Set a Linux or Mac environment variable

In Linux and Mac, you ’ ll need to set the SSLKEYLOGFILE environment varying using nano. In Linux, the variable is stored in ~/.bashrc. On the Mac, you ’ ll create the variable in the charge ~/.MacOSX/environment
Open a end and use this command in Linux :

nano ~/.bashrc

open Launchpad, snap Other, and launch a terminal to run this command in Mac OSX :

nano ~/.bash_profile

The comply steps are the lapp for both operating systems .
At the end of the file, add this line :
Bash Command

export SSLKEYLOGFILE=~/.ssl-key.log

Press Ctrl+X, Y to save your changes .
Bash Profile
close the terminal window and open another to set the variable, then type the following to confirm it ’ s been set successfully :


SSL Key Log File
After you execute the command, you should see end product alike to the picture above. /Users/comparitech/.ssl-key.log is the wax path to my SSL pre-master key log. note : You ’ ll want to make a note of yours, which will be different, to enter in Wireshark .
nowadays that the variable has been set, you can move on to the future set of steps .

Launch your browser and check for the log file

Before you launch Wireshark and configure it to decrypt SSL using a pre-master key, you should start your browser and confirm that the log file is being used .
Secure Connection
In order to populate the log, it ’ mho important that you visit a site that has SSL enabled. I ’ m using my own Apache server for testing, but any site will work. One of the biggest benefits of using a pre-master shared identify is you don’t need access to the server to decrypt SSL.

SSL Keys Log
After you ’ ve visited a SSL-enabled web site, check the charge for data. In Windows, you can use Notepad. In Linux or Mac, use the succeed command :

cat ~/.ssl-log.key

On any operate organization, your file should look like mine does above. After you ’ ve confirmed that your browser is logging pre-master keys in the location you selected, you can configure Wireshark to use those keys to decrypt SSL .

Configure Wireshark to decrypt SSL

once your browser is logging pre-master keys, it ’ randomness time to configure Wireshark to use those logs to decrypt SSL.
Wireshark Protocols
open Wireshark and chink Edit, then Preferences. The Preferences dialogue will open, and on the impart, you ’ ll see a list of items. Expand Protocols, scroll down, then chink SSL .
SSL Keys
In the list of options for the SSL protocol, you ’ ll see an entrance for (Pre)-Master-Secret log filename. Browse to the log file you set up in the previous step, or merely paste the path .
When you ’ ve finished setting the (Pre)-Master-Secret log filename, chatter OK and revert to Wireshark. You ’ re fix to move on .
Related post: How to use Wireshark

Capture the session and decrypt SSL

The final step is to capture a test session and make certain that Wireshark decrypts SSL successfully .

  • Start an unfiltered capture session, minimize it, and open your browser.
  • Visit a secure site in order to generate data, and optionally set a display filter of ‘ssl’ to minimize the session noise.
  • Click on any frame containing encrypted data.

In my case, I ’ ll select one that contains HTTP traffic with text/HTML encode, since I ’ d like to see the source code the network server is sending to my browser. But any code transmissions that use a pre-master clandestine or private samara will work with this method acting. That includes all data utilizing Perfect Forward Encryption ( PFE ) through Diffie-Hellman or comparable key exchanges .
Wireshark Logfile
once you ’ ve selected an encrypted data inning, expression at the Packet byte view, and specifically the tabs underneath the view. You should see an entrance for Decrypted SSL data, among others .
Segment data
You ’ ll notice that my seance placid looks like it ’ sulfur fully of drivel, and no HTML is visible. That ’ second because my web waiter ( and most Apache servers ) use GZIP compaction by default .
Decrypted file
When you click the Uncompressed entity body tab, which only shows up in this lawsuit with SSL decoding enabled, you can view the source code of the locate. For exemplify, here ’ s the title element of the default Apache page in plaintext .

Using an RSA key to decrypt SSL

You might have noticed earlier that Wireshark has a field that allows you to upload your RSA key and use them to decrypt SSL. In rehearse, RSA key decryption is deprecated .
SSL Decrypt

The argue decrypting SSL with an RSA key international relations and security network ’ thyroxine normally used anymore is that Perfect Forward Encryption ( PFE ) has made it disused. Sessions negotiated with Diffie-Hellman don ’ thymine habit the RSA key directly ; alternatively they generate a erstwhile key, stored lone in RAM, that is encrypted using the key on disk .

If you were previously using an RSA key to decode traffic, and it stopped working, you can confirm that the target machine is using Diffie-Hellman exchanges by enabling SSL logging .
SSL Debug
To turn on log, chatter Edit from the toolbar menu and choice Preferences. Expand the Protocols menu item on the leave and scroll down to SSL. From here, you can click the Browse clitoris and set the placement of your SSL log .
once the location is set, all SSL interactions will be logged in the specified file .
Cipher file
capture a session with your SSL-enabled host, then check the logs. specifically, you should scroll until you find the skeletal system that the TLS handshake was negotiated on. It ’ s likely that you ’ ll see a revealing DHE entry in the calculate string .
That means Diffie-Hellman key exchanges are enabled. In my case, Apache is specifically using Diffie-Hellman with elliptic-curve keys, which is denoted by the string ECDHE .
Scroll a short further and you ’ re probably to see that the headmaster secret can not be found .
Debug file
If your logs look like that, and you can ’ deoxythymidine monophosphate decode data using an RSA key, you have no choice but to switch over to the pre-master unavowed method above .
Since PFE is becoming standard drill, with TLSv1.3 probably forcing the consequence, bare RSA samara decoding is deprecated and should not be used .

Wireshark makes decrypting SSL traffic easy

I in truth like the way Wireshark handles the SSL decoding process. Cryptography is complicated, and the standards are constantly changing to be more impregnable. But once Wireshark and your environment are set up properly, all you have to do is change tabs to view decrypted data. It doesn ’ t get any easier than that .
Related : fix Common WireShark Startup ” no interfaces found ” offspring

Wireshark Decrypt SSL FAQ s

How do I read TLS packets in Wireshark?

Follow these steps to read TLS packets in Wireshark :

  1. Start a packet capture session in Wireshark.
  2. In the top menu bar, click on Edit, and then select Preferences from the drop-down menu.
  3. In the Preferences window, expand the Protocols node in the left-hand menu tree.
  4. Click on SSL. The main panel of the window will show protocol settings.
  5. Enter a file name and select a location for SSL debug file.
  6. Click in RSA keys list and then select Edit and then New.
  7. Fill out the information fields in the pop-up window: IP address, Port, Protocol (which will be HTTPS), Key File, and Password. Press OK.
  8. Click OK in the Preferences screen.

The data field at the bed of the independent Wireshark page will show the decode contents of the packet .

How does a 2 way SSL handshake work?

The bipartisan SSL handshake authenticates both the server and the customer. here are the steps that are carried out in this process :

  1. Client hello: sent from the client to the server and includes its supported cipher suites and TLS version compatibilities.
  2. Server hello: sent from the server to the client in response. It contains a link to the server’s public certificate and a request for the same back from the client.
  3. The browser validates the server certificate and if all is OK, sends a link to its own certificate.
  4. The server checks out the client’s certificate. If all is OK, session establishment continues.

Is it possible to decrypt passively sniffed SSL/TLS traffic?

Yes. however, you will always need the RSA winder in order to decrypt traffic. That could be acquired through legalize methods and with permission or could be tricked out of the informant of the traffic through a “ man in the middle ” scheme .

Leave a Reply

Your email address will not be published.