Our company connects to an external service through an outdated library (using a PHP extension for an older version of PHP). As this requires us to have a server setup in isolation for this service, I have reached out to the company to ask if there is any chance of a newer version of their extension but unfortunately not at this stage.
The extension uses a known and shared client certificate (for all clients) with a different certificate password per client.
I am interested to see how the protocol works so that we could potentially develop our own library for it using modern technologies, however due to the mutual authentication I am not sure how to go about snooping on the traffic.
For argument's sake, let's say that the service we are connecting to is
example.com (note that the server is also SSL authenticated). If we have been given a shared client certificate and a client-specific password, is it possible to snoop on this traffic, and how could we do this?
The extension specifically requires a Linux OS, so where possible, it would be very helpful if the solution or suggestions could be tailored to that environment.