I am using stunnel as a MITM to decrypt TLS traffic in between an app and its web server.
The traffic between the app and the MITM server cannot be decrypted simply with RSA cipher as the app is not accepting such cipher anymore.
The traffic between the MITM client and the webserver could be decrypted with the RSA keys method as the webserver allows the use of RSA ciphers and the MITM client is configured to use RSA ciphers only.
Thus, I captured traffic between the MITM client and the webserver. I can confirm the cipher used is from the RSA family (TLS_RSA_WITH_AES_256_GCM_SHA384).
I used to decrypt TLS 1.2 RSA traffic by using the server pem file. In this setup, I only have client RSA keys. Would it still be possible to decrypt the traffic knowing only the client's RSA keys? And where could I find them?
My stunnel client conf is as follow
[client] client = yes accept = 127.0.0.1:31337 connect = webserver.com:8888 cert = C:/whatever/stunnel/config/stunnel.pem ciphers = RSA
I tried to include the stunnel pem file in Wireshark but without success. Am I doing something wrong here?