Skip to main content
1 of 2
David Schwartz
  • 4.3k
  • 26
  • 21

The short answer is "no". The longer answer is that SSL is specifically designed to make this impossible. If this was possible, SSL would be useless for its primary intended purpose -- to secure things like credit card numbers sent to secure web sites.

The short (and technically incorrect) answer for how SSL does this is as follows:

  1. The server presents a certificate to the client.

  2. The client confirms that the certificate was signed by an organization the client trusts and that the organization certifies that the organization is the one the client wants to reach.

  3. The client generates a random key, encrypts it with the public key in the certificate, and sends it to the server.

  4. The server decrypts the key and uses the shared secret the server and client now have to secure further communications.

Decrypting the data would require at least recovering the shared secret generated at step 3. But how would you do that? It was only sent over the wire encrypted, and you don't have the server's private key.

David Schwartz
  • 4.3k
  • 26
  • 21