I would like to know which SSL certificate is used for accessing a certain website. In my browser (Chrome, FF), the icon next to the URL does not show a SSL connection. Also in Chrome it states "Your connection to the site is not encrypted". In Wireshark, however, I have a number of TLSv1 packets that transfer between the site and my machine. Is there any way to find out which certificate it is? The site contains a flash application. Can this be the reason why Chrome doesn't see the encryption?
The SSL traffic could be requests that the Flash application is making, or any subresources on the page (such as
<img src="https://..."> or
<script src="https://...">. You should be able to get information about the certificate from Wireshark. Filter on "ssl.handshake.certificate" and look for a Certificate message, and expand the Secure Sockets Layer level. I'm not sure exactly what information you're trying to get, but here you can see the certificate chain, the issuer and public key of each cert, etc. Does that help?
In Wireshark, after the ServerHello message, you should see the a Certificate message coming from the server. This will contain the server's certificate chain (the first one being the server certificate itself).
This being said, seeing a certificate doesn't necessarily imply encryption. Besides cipher suites that don't encrypt (unlikely to be used by browsers anyway, so you can ignore those), what's most likely is that there is some mixed content on the page. This could come from the Flash application or other resources.
i type http:// and it never changes to https:// while i'm on the site
If you type
http:// you won't necessarily be redirected to
https://. Why would you? Some sites implement automatic upgrades to HTTPS to try to enforce better security, but it's only partly useful. Try to connect with
https:// at least if you want to use HTTPS.