What I did:

Setup the env var "SSLKEYLOGFILE" as "C:\ssl-keys.log" and ensure it is valid.

Enter its path in Wireshark 3 preferences -> protocols -> tls -> pre-master-secret-log filename -> "C:\ssl-keys.log"

This is how the package looks in the debug file:

dissect_ssl enter frame #23 (already visited) packet_from_server: is from server - FALSE conversation = 000001BE07524340, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 39 dissect_ssl3_record: content_type 23 Application Data

All of them look like that and none of them say "is from server - TRUE" for some reason.

I have watched countless videos and read many tutorials, I still can't get it to work.

The Protocol is TLSv1.2 .

  • Can you link to a tutorial you followed? Without the exact steps you have taken (or omitted), it's impossible to help. Further, did you ever set up your RSA key list? – MechMK1 May 8 at 13:34
  • This is one of the main ones I followed -> comparitech.com/net-admin/decrypt-ssl-with-wireshark I think my specific case might be because I am on an intranet and there are security applications that may influence how the network behaves, maybe the SSL keys output is not helpful as the packets are being encrypted in a different manner. I have no idea what I am talking about, rather taking a wild guess. – Eduard G May 8 at 14:19
  • I doubt that one can help here without having access to the specific pcap and the specific key log file. And I very much doubt that your problems are related to internal security appliances since the encryption process works no different than without such appliances - only the endpoint of the encryption is different. – Steffen Ullrich May 8 at 14:25
  • I will try the same tutorial back at home and come back with results, then I can share the log files too. – Eduard G May 8 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.