This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a way to extract certificate infomation that is viewable from wireshark in tshark? For example, fields like common name, organization, serial number.

asked 30 Mar '15, 12:27

crevitch's gravatar image

crevitch
1111
accept rate: 0%


sure, you can run tshark in verbose mode and then parse the output with a script:

tshark -nr ssl.pcapng -2 -R "ssl.handshake.certificate" -V > out.txt

Example output:

               Certificate (id-at-commonName=ssl4338.cloudflare.com,id-at-organizationName=CloudFlare, Inc.,id-at-localtyName=San Francisco,id-at-stateOrProvinceName=CA,id-at-countryName=US)
                       version: v3 (2)
                       serialNumber : 0x1121c2cb499715e11699032fa4a393e81d90
                       validity
                           notBefore: utcTime (0)
                               utcTime: 14-10-15 03:29:31 (UTC)
                           notAfter: utcTime (0)
                               utcTime: 15-10-11 15:31:39 (UTC)

As an alternative, you can print whatever field sounds interesting for you: https://www.wireshark.org/docs/dfref/s/ssl.html

tshark -nr ssl.pcapng -2 -R "ssl.handshake.certificate" -T fields -e xxxx -e yyyy

Please replace xxxx and yyyy with fields listed in the reference.

Regards
Kurt

permanent link

answered 30 Mar '15, 13:01

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

For printing the certificate, I couldn't find any fields that list the url of the certificate (that work, anyway. ssl.handshake.cert_url.url_hash (URL and Hash) looked promising, but didn't give me anything on tshark 1.12.4. I finally wound up doing this: tshark -nr ssl.pcap -R "ssl.handshake.certificate" -V | grep "Certificate (id-at-commonName=" | sort | uniq > certs.txt

It would be nice if ssl.handshake.cert_url just gave you something like "amazon.com"

permanent link

answered 08 Apr '15, 11:45

John52's gravatar image

John52
1
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×3

question asked: 30 Mar '15, 12:27

question was seen: 8,040 times

last updated: 08 Apr '15, 11:45

p​o​w​e​r​e​d by O​S​Q​A