1

I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the handshake.

Any ideas how to do that? I can use openssl to get the certificate and the corresponding chain. I can use curl and its trace option to dump all incoming (response) and outgoing data (request) when performing a HTTPS request from my machine. But, curl does not provide an option to validate that the HTTPS traffic was signed using a special certificate.

Improve this question
1
  • 2
    "... validate that the HTTPS traffic was signed using a special certificate" - The question is based on a wrong understanding of HTTPS: HTTPS traffic is not signed with a certificate in the first place, thus there is no way to prove in real time or later that it was signed with a specific certificate.
    – Steffen Ullrich
    Commented May 11, 2022 at 15:40

1 Answer 1

Reset to default
1

TLSv1.3 explicitly prevents this kind of traffic analysis "at later time", i.e. without having the internal state of both sides. This is called "perfect forward secrecy" (PFS).

In TLSv1.2 or lower the analysis is at least theoretically possible - if you have the private keys of the parties.

The client doesn't have its own private key in the usual case, but the server does have and if you don't control the server, chances are you cannot have its private key. (There are even cases when you do control the server and you still cannot access its private key.)

Tools for decrypting TLSv1.2 or earlier using the private keys are widely available, e.g. wireshark.

With these limitations, the validation is rather easy - if you CAN decrypt the traffic with some particular private key, then the corresponding public key, along with its certificate, is the right one.

Improve this answer
1
  • 1
    Analysis of PFS sessions is possible if you can extract the premaster-secret from client or server (when the TLS handshake occurs) and save it with the recorded data. For example for Java programs you can enable SSL debugging or alternatively there is a module you can load into the process that outputs the premaster secrets in the format Wireshark requires for decrypting.
    – Robert
    Commented May 11, 2022 at 13:02