I have my SSL client's encrypted RSA key. I'm trying to capture the SSL traffic on a PC in the network. I understand that there are some settings I need to do on the wireshark or decrypt key. Please help me on how to do this. Thanks a lot asked 14 Sep '11, 13:11  jennyliusd |
One Answer:
Sake did an much referenced presentation at Sharkfest'09 on the subject. Check it out. answered 14 Sep '11, 13:20  Jaap ♦ showing 5 of 6 show 1 more comments |
:-) Thx for the reference Jaap!
Thx for the doc. It is very helpful. But I'm confused on removing the passphrase. Where do I type the command? On page 56: [email protected]# openssl rsa -in encrypted.key -out cleartext.key
Enter pass phrase for encrypted.key: <passphrase>
writing RSA key
[email protected]#
Where do I find the <passphrase>?
Thank you.
If the key is encrypted with a passphrase, then the administrator that provided the key to you will have the passphrase.
Do I need this for Server's key or Client's key? Sounds like I need the decrypted Server's RSA key on Wireshark, right?
On wireshark preference settings: ssl.keys_list: 192.168.3.3,443,http,c:key.pem
Is the IP address for my PC or the server?
Thank you.
You will need the (decrypted) private key of the server. And in the preferences you will use the server IP address, not the client IP address.