well this question could be asked in Wireshark forums or Stackoverflow forums but, I think the question invloves development and security factors as well so i find the Information Security forum is the suitable place for asking this question. Well straight to the point. Here's the steps I've been through until I hit a problem.
- I have a website that runs on an HTTPS protocol serving the Android application
- I generally debug requests / responses via Wireshark running on Windows operating system.
- I requested the private key to the server programmer so that I can attach it to Wireshark.
- The server programmer said he doesn't know where the key is now since the key is in a Docker image, but he will look for it soon.
- I still needed to debug my app rather than copy-pasting Log.d() all over my Android app.
- found out there was an app called "SSL" in Google Playstore and I downloaded it and tried it.
- it installs a "packet capture certificate" (which Android is pretty suspicious because it's a third party certificate)
- installed it anyways cause my testing phone is a dummy phone
- started capturing HTTPS packets that are decrypted
How can this actually work?? this application obviously knows how to retrieve packets heading to other apps. But how can it decrypt the ssl? or is it the other way around? are the apps reporting the decrypted HTTP packets to this app? Finally, is Wireshark able to decrypt packets just like the main app by exchanging keys with the server?