x509 decode with tshark

Thank you for your answe, Kurt! I use the latest stable version 1.8.4. I has tried your commands, but nothing new... I don't see any field names - only their values, as i see before.

strange, I do see all of them. They are indeed 'encoded', but easy to parse.

My example: SSL/TLS on google

https://www.cloudshark.org/captures/3d893662f9fe

Output of tshark -nr google_ssl.pcap -R "ssl.handshake.certificates" -T pdml

http://pastebin.com/sfDfd7GK

Output of tshark -nr google_ssl.pcap -R "ssl.handshake.certificates" -V

http://pastebin.com/SWmscAX2

If you look at that output, what are you missing?

Thanks! I don`t see values "name" - first values of "field". For example - container

field name="x509af.subjectPublicKeyInfo" showname="subjectPublicKeyInfo" size="162" pos="264" show="" value=""

i see like a

field name="" showname="" size="162" pos="264" show="" value=""

More the over, when try to parse certificate with your command, tshark don`t print any results. When I try to parse with option -d ber.syntax==,x509af, as I wrote before - it works, but do not print field names.

Could you try to parse your cert with my code sample? C:\ tshark.exe –r D:\cert.cap -d ber.syntax==,x509af -T pdml -V > res.txt

It`s very interest for me - will my problem repeat on your computer?

With Great Regards, Dmitriy

Thanks! I don`t see values "name" - first values of "field". For example - container

well, I do see them:

from: http://pastebin.com/sfDfd7GK

issuer: <field name="x509af.issuer" showname="issuer: rdnSequence (0)" size="72" pos="55" show="0"
validity: <field name="x509af.validity" showname="validity" size="32" pos="127" show="" value=""
not Before: <field name="x509af.notBefore" showname="notBefore: utcTime (0)" size="15" pos="129" show="0" value="

from: http://pastebin.com/SWmscAX2

issuer: issuer: rdnSequence (0)
validity:

                       validity
                            notBefore: utcTime (0)
                                utcTime: 04-05-13 00:00:00 (UTC)
                            notAfter: utcTime (0)
                                utcTime: 14-05-12 23:59:59 (UTC)

You just need to extract the data of those fields. The format is different with -V and -T pdml, but the content is the same.

So again, what is exactly missing in the output of tshark?

More the over, when try to parse certificate with your command, tshark don`t print any results.

some questions:

• Did you check my sample files, or did you try to re-create the output with your capture file?
• is your sample a HTTPS connection or something different?
• Does it use the standard port 443 or a different port (you mentioned 'decode as')?
• Can you post your capture file somewhere?

Could you try to parse your cert with my code sample? C:\ tshark.exe –r D:\cert.cap -d ber.syntax==,x509af -T pdml -V > res.txt

The output is the same as with my command, just a lot more, as you did not restrict it to 'ssl.handshake.certificate'.

First of all, take my regards for your help!

My real situation descrided below:

1) I have a certificate - I post my real test certificate here (http://files.mail.ru/U9AG66)

2) If I change it`s extension to *.pcap, then open this file with WireShark, then make "Decode as... -> Certificate" - I will have good result, something like the first picture in my first post.

Now I want take the same results by tshark for this test.pcap file.

3) I start tshark with my command: C:\Program Files\Wireshark\tshark.exe –r D:\cert.pcap -d ber.syntax==,x509af -T pdml -V > res.txt

Here is the value of res.txt - http://pastebin.com/EUVcpjXd

4) I start tshark with your command: C:\Program Files\Wireshark\tshark.exe -nr D:\cert.pcap -R "ssl.handshake.certificates" -T pdml > res.txt

Here is the value of res.txt - http://pastebin.com/qdFDaNGX

As you can see the first sample have not field names. The second sample don`t have any decoded values at all. This is the real situation and I want find design for THIS situation. I could try to parse it without field names, but it will became a big problem