-1

I tried to understand a certificate issue and capturing using Wireshark to inspect the different sequences.

The case that is not working (wifi connection through my cable provider), I see:

  • client Hello
  • server Hello
  • from again the server: Certificate, Server Key Exchange, server Hello Done

I'm able to see the certificate causing the issue (non valid).

Now the case that is working (same computer/browser), the only difference is the internet access through a LTE provider )

Wireshark shows:

  • client hello
  • server hello, change cipher spec, Encrypted Handshake Message
  • from the client change cipher spec, Encrypted Handshake Message
  • ...

I'm not able to see the certificate on the capture (I assume it's because it's encrypted (Encrypted Handshake Message)

And as this is the case that is working, i'm able to see the website with a completely different valid certificate than the 1st non-working case.

My question is about the Encrypted Handshake Message, why this sequence is triggered and is there a way to see more what happens?

Could SSL inspection (on the router/firewall) be the root cause of this certificate change? And in this case the Encrypted Handshake is done between the website and the router?

The two captures are below. You can use the display filter to remove the noise tcp.port eq 443 and ip.addr==185.230.61.0/24

With Router: Issue Certificate

ByPass Router: Works fine

  • 1
    Please provide a real packet capture (pcap, not pictures of capture) instead of only showing what you think is relevant. The Encrypted Handshake Message after the ChangeCipherSpec is perfectly normal - it is the Finished message which is the first encrypted message with TLS <= 1.2. And differences in the certificate you get might have various reasons, for example different server accessed, IPv4 vs. IPv6 used etc. Too few details too decide whats going on. – Steffen Ullrich Oct 19 '18 at 5:35
2

My question is about the Encrypted Handshake Message, why this sequence is triggered and is there a way to see more what happens?

This sequence is perfectly normal. There is no certificate in the pcap you provide ("ByPass Router: Works fine") because a previously established SSL session is resumed, i.e. an abbreviated TLS handshake is done which contains no certificate instead of a full handshake which would contain a certificate. The Encrypted Handshake Message you see after the Change Cipher Spec is likely the Finished message which marks the end of the TLS handshake and is the first message which gets encrypted.

Could SSL inspection (on the router/firewall) be the root cause of this certificate change?

Looking at the pcap for "With Router: Issue Certificate" it seems that some kind of SSL man in the middle is taking place. This might be the attempt of doing SSL interception or it might also be some captive portal. The certificate returned is for prod1.shp.mcafee.com and is issued by McAfee OV SSL CA 2 - which neither matches the name of the site you want to reach (www.hatim-benmeziane.com) nor is the certificate which I can get when I try to access the site (i.e. no misconfiguration).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.