Hi,
We are using tshark to get visibility into our SSL
environment. In some case tshark only decrypts the requests but not the
responses when run in http protocol. So our parameter looks like this
ssl.keys_list:192.168.15.30,443,http,/home/application/cert.pem
if we run tshark with
the following command
ssl.keys_list:192.168.15.30,443,data,/home/application/cert.pem
We can see both the decrypted request and response but in
the data format. Why is that it can’t decrypt the response in http
protocol but it can in data protocol?
I appreciate any insight
Al