This is our old Q&A Site. Please post any new questions and answers at

Is there a way to extract certificate infomation that is viewable from wireshark in tshark? For example, fields like common name, organization, serial number.

asked 30 Mar '15, 12:27

crevitch's gravatar image

accept rate: 0%

sure, you can run tshark in verbose mode and then parse the output with a script:

tshark -nr ssl.pcapng -2 -R "ssl.handshake.certificate" -V > out.txt

Example output:

               Certificate (,id-at-organizationName=CloudFlare, Inc.,id-at-localtyName=San Francisco,id-at-stateOrProvinceName=CA,id-at-countryName=US)
                       version: v3 (2)
                       serialNumber : 0x1121c2cb499715e11699032fa4a393e81d90
                           notBefore: utcTime (0)
                               utcTime: 14-10-15 03:29:31 (UTC)
                           notAfter: utcTime (0)
                               utcTime: 15-10-11 15:31:39 (UTC)

As an alternative, you can print whatever field sounds interesting for you:

tshark -nr ssl.pcapng -2 -R "ssl.handshake.certificate" -T fields -e xxxx -e yyyy

Please replace xxxx and yyyy with fields listed in the reference.


permanent link

answered 30 Mar '15, 13:01

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

For printing the certificate, I couldn't find any fields that list the url of the certificate (that work, anyway. ssl.handshake.cert_url.url_hash (URL and Hash) looked promising, but didn't give me anything on tshark 1.12.4. I finally wound up doing this: tshark -nr ssl.pcap -R "ssl.handshake.certificate" -V | grep "Certificate (id-at-commonName=" | sort | uniq > certs.txt

It would be nice if ssl.handshake.cert_url just gave you something like ""

permanent link

answered 08 Apr '15, 11:45

John52's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 30 Mar '15, 12:27

question was seen: 9,741 times

last updated: 08 Apr '15, 11:45

p​o​w​e​r​e​d by O​S​Q​A