Revision history [back]

Revision 1

answered 2021-06-25 12:28:32 +0000

The ClientCertificate is spread over frames 10, 11 and 12. In order for Wireshark to display the certificate, it needs to reassemble those frames and then it will show the Certificate in frame 12. If you use the default Wireshark profile, this should work. If you use a custom profile, please make sure that:

Checksum checking is disabled in the IP and TCP protocol preferences
Reassembly is enabled in the TCP and the TLS protocol preferences

Tshark should give the following output for your current profile if all is set correctly:

$ tshark  -G currentprefs | egrep '^#?(ip|tcp|tls)\..*(checksum|desegment).*'
#ip.check_checksum: FALSE
#tcp.check_checksum: FALSE
#tcp.desegment_tcp_streams: TRUE
#tls.desegment_ssl_records: TRUE
#tls.desegment_ssl_application_data: TRUE
$