Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. Is there an explanation for this behaviour?

A bit more detail: we used openssl to generate keys and certificates with the command: openssl req -config *.cnf -new -x509 -extensions v3_ca -keyout *.key -out *.crt -days 1825

and then to decrypt the private key to a PKCS#8 format, which wireshark supposedly supports, we issued this command: openssl pkcs8 -nocrypt -in *.key -informat DER -out *.key -outformat PEM

In Wireshark we issued the following parameters in SSL decryption section: 10.10.10.10,443,http,*.key - where 10.10.10.10 is the client we're trying to MITM using sslsniff. We have also tried localhost and servers IP with no success. Any suggestions?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

The SSL connection was probably using Diffie-Hellman to establish the session key. DH allows two parties to establish a shared secret over an insecure channel with no prior communication. This means that even though you have the private key, you can't determine the session key by inspecting the traffic. To decode a DH session you have to actively MITM the connection, or get one of the parties to log the session key.

share|improve this answer
add comment

You will have to capture and then configure wireshark to decrypt.

Check out this tutorial (Steps 2 and 3 seem to address your problem)

May also want to check this out

share|improve this answer
    
Thanks for the reply, but I've actually used that guide and ended up only being able to decrypt the headers. –  user1049697 Feb 13 '12 at 20:13
    
@user1049697 This person was unable to see packets because he used a Diffie-Hellman cipher. seclists.org/wireshark/2009/Nov/75 –  sealz Feb 13 '12 at 20:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.