I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I can't sniff with tshark. For example my tshark command is:
tshark -o "ssl.desegment_ssl_records: TRUE" -o "ssl.desegment_ssl_application_data: TRUE" -o "ssl.keys_list: 209.190.x.x,443,http,/etc/squid/ssl/file/squid.key" -o "ssl.debug_file: /tmp/.wireshark-log" -i eth0 -R "http.request.method==GET or http.request.method==POST"
I know that squid works (and I can sniff all data from http), and I can see the log of https site in
/var/log/squid/access.log but I can't sniff full data of https. I also know Squid becomes a man-in-the-middle in this scenario and makes 2 SSL keys. One between the client and squid, the other between squid and the server. I can't sniff the data between the client and squid but I think I can sniff data between server (me) and squid.
How can I sniff it? Is there any alternative for tshark?