Forum Discussion

  • jaikumar_f5's avatar
    jaikumar_f5
    Icon for Noctilucent rankNoctilucent
    May 31, 2017

    Yes you can decrypt the data by specifying the path, Use SSLDUMP command,

    ssldump -Aed -nr /var/tmp/yourpacketcapture.cap -k /config/filestore/files_d/Common_d/certificate_key_d/:Common:www.site.com.key_1

  • dragonflymr's avatar
    dragonflymr
    Icon for Cirrostratus rankCirrostratus
    May 31, 2017

    Hi,

     

    Possibility to decrypt traffic depends on ciphers used. If RSA key exchange is used it should be possible to decrypt, if DH is used or any other Forward Secrecy or Perfect Forward Secrecy cipher suites then it is not possible.

     

    It is not possible as well to decrypt resumed session. Capture must contain full SSL Handshake.

     

    Piotr