Openssl s_server -key testkey.pem -cert testcert.pem -WWW -cipher RC4-SHA -accept 443 Now we’re ready to fire up our HTTPS server: Openssl rsa -in testkey.pem -out testkey.pem We need to perform one tiny tweak to the format of the private key file (Wireshark will use this later on, and it won’t work properly until we’ve done this): Openssl x509 -in testcert.pem -text -noout (output here more info here) Openssl rsa -in testkey.pem -text -noout (output here) You can look at the contents of your key and certificate files in more detail like this: PEM (Privacy Enhanced Mail) format files are plaintext, and consist of a BASE64 encoded body with header and footer lines. OpenSSL will ask you for some input to populate your certificate with once you’ve answered all the questions, the output of this command is two files, testkey.pem (containing a 1024 bit RSA private key) and testcert.pem (containing a self signed certificate). Openssl req -x509 -nodes -newkey rsa:1024 -keyout testkey.pem -out testcert.pem To begin with, we need to get ourselves a self-signed certificate that our HTTPS server can use. To illustrate the process, we’re going to use OpenSSL to generate a certificate and act as a web server running HTTP over SSL (aka HTTPS) – it’s quite straightforward. Step one – set up an SSL-protected server to use as a testbed I’m running the 2012 Brighton Half Marathon in aid of Help for Heroes – please sponsor me if you can by clicking the link to the right: How to decrypt SSL with Wireshark

What better way to understand something than to take it apart and put it back together again? Having the best signatures in the world won’t help if all your sensors see is encrypted traffic. Feeding a decrypted traffic stream to an IDS.Debugging applications that run over SSL (HTTP, SMTP, POP3, IMAP, FTP, etc).Why decrypt SSL?Īside from the obvious malicious uses, decrypting SSL has uses such as: This post is about why you might want to do it, how to do it, why it works, and how to decrease the chances of other people being able to decrypt your “secure” traffic. A neat feature of Wireshark is the ability to decrypt SSL traffic.

How to decrypt wireshark capture