1

I would like to know which SSL certificate is used for accessing a certain website. In my browser (Chrome, FF), the icon next to the URL does not show a SSL connection. Also in Chrome it states "Your connection to the site is not encrypted". In Wireshark, however, I have a number of TLSv1 packets that transfer between the site and my machine. Is there any way to find out which certificate it is? The site contains a flash application. Can this be the reason why Chrome doesn't see the encryption?

Improve this question
5
  • no, I checked where the SSL traffic goes from and to. The IP belongs to a server of the same company that runs the website.
    – hansi
    Dec 20, 2012 at 23:25
  • 1
    Chances are the page loads unecrypted and the encrypted traffic is sent by the Flash application. When you load up this 'certain website' do you type https://... or http://?
    – Nik Bougalis
    Dec 20, 2012 at 23:25
  • i type http:// and it never changes to https:// while i'm on the site
    – hansi
    Dec 20, 2012 at 23:26
  • is there a way to figure out the certificate used by the flash application?
    – hansi
    Dec 20, 2012 at 23:32
  • Right - you type http and so your connection to the server is not encrypted. As for figuring out the certificate, no idea what mechanisms Flash offers. Why do you need this information?
    – Nik Bougalis
    Dec 20, 2012 at 23:38

2 Answers 2

Reset to default
3

The SSL traffic could be requests that the Flash application is making, or any subresources on the page (such as <img src="https://..."> or <script src="https://...">. You should be able to get information about the certificate from Wireshark. Filter on "ssl.handshake.certificate" and look for a Certificate message, and expand the Secure Sockets Layer level. I'm not sure exactly what information you're trying to get, but here you can see the certificate chain, the issuer and public key of each cert, etc. Does that help?

wireshark cert info

Improve this answer
0

In Wireshark, after the ServerHello message, you should see the a Certificate message coming from the server. This will contain the server's certificate chain (the first one being the server certificate itself).

This being said, seeing a certificate doesn't necessarily imply encryption. Besides cipher suites that don't encrypt (unlikely to be used by browsers anyway, so you can ignore those), what's most likely is that there is some mixed content on the page. This could come from the Flash application or other resources.

i type http:// and it never changes to https:// while i'm on the site

If you type http:// you won't necessarily be redirected to https://. Why would you? Some sites implement automatic upgrades to HTTPS to try to enforce better security, but it's only partly useful. Try to connect with https:// at least if you want to use HTTPS.

Improve this answer

You must log in to answer this question.