First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

How to capture HTTPS traffic with v3.0.2?

Hello, I'm trying to figure out how to capture Chrome HTTPS traffic at Windows 7 with Wireshark and have already read tons of manuals and guides. But still, my Wireshark v.3.0.2 does not decrypt TLSv1.2 traffic. Here is what I do:

  • set environmental variable SSLKEYLOGFILE

  • start Chrome with --ssl-key-log-file="...path..." key

  • in Wireshark, set Edit -> Preferences -> Protocols -> TLS -> "(Pre)-Master-Secret log filename" to the same as in both lines above

  • starting capture

According to most guides, this should be enough.

Yet, still no decrypted data being showed at capture log. I'm still getting that "Encrypted Application Data" and no additional tabs showing below. There is no "SSL" protocol in Preferences as well, but most guides references to it so I'm being confused a lot if I doing something wrong. Still, can't get any clue not in google, nor here.

Checked it at various sites, even at httpbin.org, was trying to start capture first, browser first, rebooting, etc - still the same result, no HTTPS traffic decryption.

Chrome make it's secret log file perfectly and seem to be writing it correctly.

username's avatar
1
username
asked 2019-06-07 23:49:30 +0000, updated 2019-06-07 23:57:07 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

2 Answers

0

The preference (and the associated dissector) has been renamed in Wireshark 3.0 and later to "TLS", because no-one is actually using SSL these days. Unfortunately those guides haven't caught up.

grahamb's avatar
23.8k
grahamb
answered 2019-06-10 17:12:11 +0000, updated 2019-06-10 17:12:37 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments
0

If you can absolutely not decrypt any traffic even if the key log file is correctly written and configured in Wireshark, my guess is that you have some kind of anti-virus software running that basically terminates your TLS connection and creates a new connection.

If that is the case, you should be able to observe Certificate messages that are not signed by a trusted Certificate Authority (CA).

Lekensteyn's avatar
2.3k
Lekensteyn
answered 2019-06-10 17:39:36 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer