SSL/TLS encryption is done end-to-end, meaning only each end can successfully decrypt the session. The point of it being that Wireshark, or other network capture/sniffing tools, cannot eavesdrop on the data contained.
In a LAN or corporate environment, SSL interception looks like this:
- Client workstations tries to go to
- Inspection appliance sees this, and on-the-fly replaces
https://somesite's certificate with a corporate certificate.
- Each workstation on the network trusts the corporate certificate, so no error is displayed.
- The client then encrypts the request with the corporate certificate, allowing the internal appliance to decrypt and inspect the traffic.
- If all is well, the inspection appliance will re-encrypt the data using
https://somesite's certificate, and then pass it on to the destination, and replies back to the workstation.
In such a way, the endpoints are really
https://somesite and the inspection appliance. Another session happens between the workstation and the inspection appliance which is essentially relayed to its final destination.
Essentially, the inspection appliance in this case is performing what is known as a "man-in-the-middle" attack, except ostensibly with permission to do so.