I guess another way is to extract the private key from pkcs12 file and then add it as RSA key in wireshark.I have an SSL trace on CloudShark below my question. wish everyone can solve the challenge they encounter while learning. I am so happy I figured this out so that I learn about how http2 encoding the body message and Wireshark usage, and verify json is still being sent in ASCII rather than binary. Then we can view decrypted data directly in wireshark: If you use a browser, you just need to export the env var in the terminal or shell:Įxport SSLKEYLOGFILE= SSLKEYLOGFILE= curl -http2 -v -k -X POST -H 'Content-Type: application/json' -d '' We just need to put SSLKEYLOGFILE= at the very beginning of the curl command I am gonna run: The second step is to just enable logging for your client which can be curl utility or browser. Here tlskey.log is just an empty file created by myself Therefore we need to log this key which is allowed for debugging purposes: Steps: I think I figure out the answer on my own:įirst, as point out, the key is generated by the client and then is safely encrypted using public key and sent to the server. So I follow the example with ssl on the website but the key is not showing up lol However when capturing the packet using wireshark, it is encrypted but I really don't know how to use the cert to decrypt it. Keytool -genkey -alias undertow -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore keystore.p12 -dname 'CN=localhost, OU=localhost, O=localhost, L=Zhengzhou, ST=Henan, C=CN' I am doing this is because I have used keytool to generate the key/cert and run a small http2 server with this cert/key: Is there another way to view the comments? Can anyone try the linked file:įile: http2-16-ssl.pcapng (HTTP2 with ALPN h2-16 extension) (5.1 KB, from, SSL keys in capture file comments) On the wireshark website, it says the SSL keys are in the comment but I just didn't see it. To follow decryption example from wireshark:I download the capture file but didn't see the key in the comments of that capture file:

Wireshark mac applicatin data ssl