I am trying to decrypt SSL traffic between a client (Firefox) and a Squid Proxy server that is using ssl-jump. The SSL certificate on the server is a private cert linked to the ssl-bump feature. I am using tshark to dump the SSL traffic. I know all the certificates work fine because when I take Squid out of the path I can decrypt the traffic. However as soon as the SSL traffic is destined for the proxy on port 3128 I can't decrypt it. For example I can create a client key, run up a server on 4443 using openssl and dump the traffic with these commands.
However I can't dissect the traffic when I send via Squid, I have tried the 'http' and 'data' dissector to no avail ;( tshark -o "ssl.desegment_ssl_records: TRUE" -o "ssl.desegment_ssl_application_data: TRUE" -o "ssl.keys_list:0.0.0.0,3128,data,/home/me/privkey.pem" -o "ssl.debug_file: /home/me/.wireshark-log" -i eth0 -R "tcp.port == 3128" Is there a way to decrypt the traffic when it I am using Squid proxy and certificates I have configured to use via Squid's ssl-bump? Regards, Michael asked 31 May '11, 23:00  cloudjunky |
One Answer:
When you use ssl-bump, Squid becomes a man-in-the-middle. This means there are actaully two ssl sessions. One between the client and squid, the other between squid and the server. You should be able to decrypt the session between squid and the server, however, for the session between the client and squid, there is a new certificate being created by squid. Of course it does not have the server key, so a new key is generated and used for that session. Therefor you can't decrypt it... ...however, in very recent automated development builds, you can use the openssl s_client output (in which the Master Secret is logged) to decrypt the session. See this question for more details. answered 01 Jun '11, 23:13  SYN-bit ♦♦ |
