I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS.
I've read Extract pre-master keys from an OpenSSL application and especially excellent walkthrough Extracting openssl pre-master secret from apache2 and I was able to record keys from apache, but still have no success with nginx. Perhaps I'm missing something obvious?
I'm using Debian 9 system for testing. First I check which version of openssl is used by nginx:
# nginx -V 2>&1 |grep SSL built with OpenSSL 1.1.0k 28 May 2019 # ldd /usr/sbin/nginx |grep ssl libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f9bd9f95000)
So I installed
libssl-dev package which provides
I downloaded sslkeylog.c and compiled it:
cc sslkeylog.c -shared -o libsslkeylog.so -fPIC -ldl
I put compiled library into
/usr/local/lib/libsslkeylog.so path for convenience.
Then I edited nginx's systemd config:
#cat /etc/systemd/system/nginx.service.d/override.conf [Service] Environment=SSLKEYLOGFILE=/tmp/premaster.txt Environment=LD_PRELOAD=/usr/local/lib/libsslkeylog.so # systemctl daemon-reload # systemctl restart nginx
I can see that
LD_PRELOAD works -
lsof of both master and worker nginx processes show that
/usr/local/lib/libsslkeylog.so is loaded:
# lsof -n -p 10313 |grep ssl nginx 10313 root mem REG 254,1 442984 3255 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 nginx 10313 root mem REG 254,1 14224 20914 /usr/local/lib/libsslkeylog.so # lsof -n -p 10314 |grep ssl nginx 10314 www-data mem REG 254,1 442984 3255 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 nginx 10314 www-data mem REG 254,1 14224 20914 /usr/local/lib/libsslkeylog.so
But after I access nginx through curl
curl -k -I https://localhost
or through browser on my PC,
/tmp/premaster.txt is not created
What am I doing wrong? Or is there a better way to store pre-master keys in nginx?