Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. Is there an explanation for this behaviour?

A bit more detail: we used openssl to generate keys and certificates with the command: openssl req -config *.cnf -new -x509 -extensions v3_ca -keyout *.key -out *.crt -days 1825

and then to decrypt the private key to a PKCS#8 format, which wireshark supposedly supports, we issued this command: openssl pkcs8 -nocrypt -in *.key -informat DER -out *.key -outformat PEM

In Wireshark we issued the following parameters in SSL decryption section:,443,http,*.key - where is the client we're trying to MITM using sslsniff. We have also tried localhost and servers IP with no success. Any suggestions?

share|improve this question
up vote 5 down vote accepted

The SSL connection was probably using Diffie-Hellman to establish the session key. DH allows two parties to establish a shared secret over an insecure channel with no prior communication. This means that even though you have the private key, you can't determine the session key by inspecting the traffic. To decode a DH session you have to actively MITM the connection, or get one of the parties to log the session key.

share|improve this answer

You will have to capture and then configure wireshark to decrypt.

Check out this tutorial (Steps 2 and 3 seem to address your problem)

May also want to check this out

share|improve this answer
Thanks for the reply, but I've actually used that guide and ended up only being able to decrypt the headers. – user1049697 Feb 13 '12 at 20:13
@user1049697 This person was unable to see packets because he used a Diffie-Hellman cipher. – sealz Feb 13 '12 at 20:17

Could you have been mistaking encrypted data for compressed data? Web servers usually use some form of data compression (gzip or deflate) which could obscure the payload to look like it was encrypted.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .