Wireshark-users: Re: [Wireshark-users] SSL decryption -- RSA Key format

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Vijay Sitaram <vjatfugen@xxxxxxxxx>
Date: Wed, 1 Nov 2006 19:23:32 -0800 (PST)
Hi Brian,
 
     Thanks for confirming that SSL decryption worked.  So far I have not been able to get the decryption working on my end.
 
    Can you please confirm the version of gnutls and libgcrypt that you are using?  Also, it would be great if you can copy and paste the output from ssldebug.txt.
 
     Kind regards,
 
Vijay


"Baker, Brian" <brian@xxxxxxxxxxxxxxxxxxxxx> wrote:
I was using the Wireshark GUI (on Win32).  The steps you listed below were the same ones I had seen elsewhere and they worked correctly.
 
Brian Baker
 
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Vijay Sitaram
Sent: Friday, October 27, 2006 7:12 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] SSL decryption -- RSA Key format
 
Are you using Wireshark or the command line 'tshark' for this decryption?  I have been trying to decrypt SSL traffic for the last couple of weeks but have not been successful as of yet.
 
    Here are the steps to export an IIS certificate to a private key file:
  1. Click on View Certificate under Directory Security tab (when viewing the Defaul Web Site Properties).
  2. Click on Details tab and Copy To File�
  3. Click on Next for the Certificate Export wizard.
  4. Choose Yes under Export Private Key option and click on Next.
  5. Uncheck Enable strong protection option and click on Next.
  6. Click on Next on the password dialog (don't enter a password).
  7. Enter a file name such as C:\Temp\www.something.com-w3svc.pfx and click on Next.
  8. Click on Finish and Click on OK.
  9. Copy the exported file to a machine running OpenSSL and execute the following command:
  10. openssl pkcs12 -in /path/to/www.something.com-w3svc.pfx -out /path/to/www.something.com-w3svc-Key.pem -nodes -nocerts
   In theory you should then be able to use a command such as the follows to decrypt SSL traffic:
tshark -V -r rsasnakeoil2.cap -o "ssl.keys_list: 127.0.0.1,443,http,/path/to/snakeoil2/rsasnakeoil2.key" -o "ssl.debug_file: /path/to/snakeoil2/ssldebug.txt" > output.txt

  Please let share your experiences if your decryption attempts are successfull.
 
  Kind regards,
 
Vijay
 
 
 
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users

Get your email and see which of your friends are online - Right on the new Yahoo.com