0

I am trying to develop a test tool to validate a SOAP-based protocol that is served over HTTPS.

My problem is that if I have any issue in the protocol, I cannot use wireshark to debug it, because the traffic is encrypted.

Is it possible to generate with openssl a certificate that has a nihil cyper?

  • There are protocol analysis programs that act as proxies. They allow you to view unencrypted HTTPS traffic. A couple of them are Fiddler and Burp Suite. I've used Fiddler before and it works fine. Separately Chrome and Firefox support the SSLKEYLOGFILE environment variable, which writes the SSL session key to a file, which Wireshark can consume. I'm guessing a browser is not the client endpoint of your SOAP protocol, so you couldn't use this directly. You could however implement the same support in your endpoint (if you can build the endpoint) – Χpẘ May 3 '17 at 16:27
3

The TLS ciphersuite selected (which may use NULL encryption) is independent from the certificate used, i.e. just use a normal certificate with one of the "WITH_NULL" ciphersuites:

https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4

Another alternative is to configure wireshark to decrypt the traffic (this requires wireshark to have access to the private key):

https://wiki.wireshark.org/SSL#Wireshark

| improve this answer | |
  • Decrpytion in wireshark only works, if you disable all ciphersuites which use Diffie-Hellman key exchange. – mat May 4 '17 at 10:41
0

Yes and no.

Yes: X.509 certificates almost always have either a keyUsage or a extendedKeyUsage extension, which regulates how the certificate is to be used. If you ommit the values dataEncipherment and keyEncipherment at this point and set it to something else (like digitalSignature) , every application adhering to the standard must not use the certificate's key for encryption.

No: Every X.509 certificate contains a public key which can theoretically be used to encrypt data, no matter what the standard orders you to do.

Bottom line: You can not technically prohibit someone from doing encryption with a key in a X.509 certificate. Your best shot is to set the keyUsage to a appropriate value and to use an ECC key instead of an RSA key, since ECC encryption is something that is not done very often.

| improve this answer | |
  • As another answer pointed out, RSA is not (normally) used for encryption in SSL. Instead RSA is used for authentication in SSL. So the certificate attributes don't play a role in the encryption algorithm used in an SSL session. – Χpẘ May 3 '17 at 16:13
  • @Χpẘ Not neccesarily. There are cipher suites which use the RSA key of the server for an encrypted key exchange (instead of DH). – mat May 4 '17 at 10:42
  • But that's still not using RSA to encrypt the payloads, which is what the OP is asking about. – Χpẘ May 4 '17 at 15:57
  • Is he? That's not how I read the question. But it is not stated very clear. – mat May 4 '17 at 18:04
  • The way I read it is that he wants to view the decrypted traffic via Wireshark. (The other answer seems to have the same interpretation I do.) I think OP misunderstands the role the certificate plays in establishing an SSL session - hence his question about certificate attributes. BTW, it is interesting to know that RSA can be used for key exchange – Χpẘ May 4 '17 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.