3

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL dissector preference in Wireshark with local IP address and my private key.

enter image description here enter image description here enter image description here

However, the messages in Wireshark are still encrypted.

enter image description here

What did I miss?

21
  • This isn't an InfoSec question, but a application config question.
    – schroeder
    Feb 12, 2015 at 0:36
  • 1
    @schroeder Really? I posted it here because several related posts I read online all came from here. Where do you suggest me post it?
    – an0
    Feb 12, 2015 at 0:45
  • @schroeder - if you check the help center questions about security tools are specifically on topic. Unfortunately, I can't vote against your close vote.
    – paj28
    Feb 12, 2015 at 9:20
  • 1
    Interestingly, this was just posted on reddit/netsec jimshaver.net/2015/02/11/…
    – paj28
    Feb 12, 2015 at 10:01
  • 1
    (1) Charles is using a .pfx file, which contains a cert (or chain, not applicable here) and key. The tutorial you link to says about four times you are generating both cert and key for the fake CA. But my question is the key used in and with the leaf certs not the CA cert. (2) The selected ciphersuite is in the ServerHello message which you should see in Wireshark; the name has several components that specify the key-exchange used, the symmetric cipher, and the hash for HMAC (and/or KDF in TLS1.2). But: ... Feb 14, 2015 at 0:05

1 Answer 1

1

I encountered the exact same problem with Charles Proxy in combination with Wireshark.

I think the issue is that Charles sends two (or more) certificates to the client (check the Certificate message sent from proxy to the client). Wireshark will then use the first certificate in that list, which probably will not match the private key you generated.

(This is exactly what user dave_thompson_85 is wondering in the comments.)

I have checked this by extracting the certificate from Wireshark. Note that Wireshark extracts the certificate in .der format. Then I have converted the .der-file to a .pem certificate:

openssl x509 -inform DER -outform PEM -text -in wireshark_charles.der -out wireshark_charles.pem

I also have converted the .pem to a .crt, but this is not necessary.

Certificate sent by Charles to client

$ openssl x509 -noout -modulus -in wireshark_charles.crt | openssl md5

7a37a32781daf79402623c19ac9c8d7f

Custom certificate set up in Charles

$ openssl x509 -noout -modulus -in charles_custom.crt | openssl md5

62ea5ed061fca62efaaecbbb0226b08e

The corresponding private key

$ openssl rsa -noout -modulus -in charles_custom.pem | openssl md5

62ea5ed061fca62efaaecbbb0226b08e

The modulus of the certificate sent by Charles does not match the modulus of the custom generated private key.

And Wireshark also logs this issue during the SSL Dissection:

ssl_decrypt_pre_master_secret wrong pre_master_secret length (128, expected 48)
ssl_generate_pre_master_secret: can't decrypt pre master secret

Charles generates a new per-host certificate using the custom certificate as root certificate. Unfortunately, I have not found a way to extract this per-host private key generated by Charles. I suggest to use Burp Proxy. In Burp you can select which type of certificate you want to use.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .