On Ubuntu Linux, wireshark fails to decrypt an SSL session which does NOT use a DH cipher.
Firefox uses a Squid proxy server. The connection between Firefox and Squid takes place over a Stunnel's SSL tunnel. The interesting thing is that when I remove stunnel and connect: Here are links to wireshark capture with stunnel (failed to decrypt): SSLkeylogfile generated during this session: Debug file (frame 22 is of interest): asked 04 Aug '13, 14:46 dansmith edited 05 Aug '13, 02:38 |
One Answer:
The solution turned out to be a bizarre one. stunnel A was listening on a random port 33308 when decryption was failing. As soon as I would make stunnel A listen on ports 80 or 8080, the decryption would succeed, for any other ports it would fail. I'm completely mistified. How can a port number influence the decryption of an SSL session? answered 09 Aug '13, 05:15 dansmith edited 09 Aug '13, 05:19 |