I want to intercept a ssl-encrypted tcp-stream. I have the privat key and the certificat of the server and of the client. But how can I intercept the connection.
Is there a intercepting-proxy with such a feature?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
You are typically trying to perform a Man in the Middle. There are many ways to do it.
Web Proxy -You can achieve this by:
You need to create a new certificate that claims to be for any end point and that is trusted by the browser. Your proxy then delivers that certificate instead of the genuine one creating a man-in-the-middle.
Traffic is encrypted using your false cert between the browser and the proxy then re-encrypted using the genuine cert between the proxy and the end point.
There certainly are services that will do this, Sophos for example have one.
WireShark supports intercepting ssl traffic when using RSA for key exchange but now with people using Perfect Forward Secrecy, you will need the session key which can be obtained if you are using Firefox or Chrome. See this link on how to obtain that and use wireshark to decrypt the traffic.
If you are not using Perfect Forward Secrecy then it should be straight forward. If you are using it and your client is something other than Chrome or Firefox then you will have to do some further digging in how to get the session key from your client (if you have control over it)