Now on the main screen of Wireshark, it will show a list of possible adapters to capture from. As shown above, you need to set this value to the same location as the SSLKEYLOGFILE for your browser. At this point, you should see something similar to the screen below.Īt the bottom of this screen, there is a field for (Pre)-Master-Secret log filename. Select Protocols in the left-hand pane and scroll down to TLS. For this reason, it’s important to have Wireshark up and running before beginning your web browsing session.īefore we start the capture, we should prepare it for decrypting TLS traffic. If you want to decrypt TLS traffic, you first need to capture it. Once this is complete, we have everything that we need for decrypting TLS traffic. Once the environment variable has been set, it’s advisable to restart the system to ensure that the new settings are active. An example of this variable in Windows is shown below. On Windows, it can be set by opening Advanced System Settings, selecting Environment Variables and then adding a new System Variable. On Linux, this variable can be set using the Export command. If this variable is set, both browsers are configured to save a copy of the client’s secrets to the indicated file location.

In Firefox and Chrome, this can be accomplished by setting an environment variable called SSLKEYLOGFILE. Since we’re acting as an eavesdropper on the network (the exact thing that TLS is designed to prevent), we need to have one of the trusted parties share their secrets with us.

Since TLS is designed to protect the confidentiality of the client and the server during transmissions, it’s logical that it’s designed so that either of them can decrypt the traffic but no one else can. The other thing that you’ll need to do before decrypting TLS-encrypted traffic is to configure your Web browser to export client-side TLS keys. The first step in using it for TLS/SSL encryption is downloading it from here and installing it. Wireshark is a commonly-known and freely-available tool for network analysis.

Wireshark https traffic