I’m using Wireshark v1.10.1.
I have provided the private key to Wireshark SSL protocol preference. But the TLS traffic isn’t decrypted. Here is my Wireshark SSL debug file.
Wireshark SSL debug log
ssl_association_remove removing TCP 443 - http handle 03B40638
Private key imported: KeyID 9d:d0:e4:66:dd:8e:fb:cf:ea:e4:96:52:cc:92:29:67:...
ssl_load_key: swapping p and q parameters and recomputing u
ssl_init IPv4 addr '172.16.0.254' (172.16.0.254) port '443' filename 'C:\test\cert.pem' password(only for p12 file) ''
ssl_init private key file C:\test\cert.pem successfully loaded.
association_add TCP port 443 protocol http handle 03B40638
Private key imported: KeyID 9d:d0:e4:66:dd:8e:fb:cf:ea:e4:96:52:cc:92:29:67:...
ssl_load_key: swapping p and q parameters and recomputing u
ssl_init IPv4 addr '172.16.252.1' (172.16.252.1) port '443' filename 'C:\test\cert.pem' password(only for p12 file) ''
ssl_init private key file C:\test\cert.pem successfully loaded.
association_add TCP port 443 protocol http handle 03B40638
dissect_ssl enter frame #8 (first time)
ssl_session_init: initializing ptr 06041F98 size 592
conversation = 06041D84, ssl_session = 06041F98
record: offset = 0, reported_length_remaining = 109
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 104, ssl state 0x00
association_find: TCP port 4287 found 00000000
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 1 offset 5 length 100 bytes, remaining 109
packet_from_server: is from server - FALSE
ssl_find_private_key server 172.16.0.254:443
dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
dissect_ssl enter frame #10 (first time)
conversation = 06041D84, ssl_session = 06041F98
record: offset = 0, reported_length_remaining = 137
dissect_ssl3_record found version 0x0301(TLS 1.0) -> state 0x11
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 81, ssl state 0x11
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86
dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
ssl_restore_session can't find stored session
trying to use SSL keylog in
failed to open SSL keylog
cannot find master secret in keylog file either
dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x17
dissect_ssl3_hnd_srv_hello trying to generate keys
ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
dissect_ssl3_hnd_srv_hello can't generate keyring material
record: offset = 86, reported_length_remaining = 51
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - TRUE
ssl_change_cipher SERVER
record: offset = 92, reported_length_remaining = 45
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 40, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 188 offset 97 length 1583727 bytes, remaining 137
………………..
asked 29 Jul ‘13, 21:08
Yuji
11●1●1●2
accept rate: 0%
edited 30 Jul ‘13, 00:51
SYN-bit ♦♦
17.1k●9●57●245