To illustrate the process, we’re going to use OpenSSL to generate a certificate and act as a web server running HTTP over SSL (aka HTTPS) – it’s quite straightforward. Step one – set up an SSL-protected server to use as a testbed I’m running the 2012 Brighton Half Marathon in aid of Help for Heroes – please sponsor me if you can by clicking the link to the right: How to decrypt SSL with Wireshark What better way to understand something than to take it apart and put it back together again? Having the best signatures in the world won’t help if all your sensors see is encrypted traffic.

Feeding a decrypted traffic stream to an IDS.Debugging applications that run over SSL (HTTP, SMTP, POP3, IMAP, FTP, etc).Why decrypt SSL?Īside from the obvious malicious uses, decrypting SSL has uses such as: This post is about why you might want to do it, how to do it, why it works, and how to decrease the chances of other people being able to decrypt your “secure” traffic. A neat feature of Wireshark is the ability to decrypt SSL traffic.

Decrypt https traffic wireshark