Forum Discussion
unable to decrypt SSL traffic using private key
Hello Experts,
I have a simple F5 LTM lab using Virtual Edition Lab License (F5-BIG-VE-LAB-LIC).
Diagram: Client<--->F5<--->Server.
Setup: SSL offload on the LTM. SSL access is working from client to server. SSL handshake is going through. I can access the webpage.
Problem: I'm trying out SSLDUMP to decrypt the encrypted application data using private key, but it doesn't show the decrypted format. And my SSLDUMP still show application data. This F5 has only one private key intended for this setup. I have tried also exporting the premasterkey and load it to wireshark to see if I can decrypt the data, but still can not.
I am following this guide: https://support.f5.com/kb/en-us/solutions/public/10000/200/sol10209.html
Appreciate all your inputs
Regards, LLeyton
5 Replies
- Kevin_Stewart
Employee
"Passive" decryption with access to the private key can only work with the RSA key exchange. In other words, if the client and server negotiate with anything other than RSA (i.e. anything using Diffie-Hellman) then it cannot work.
- Kevin_Stewart
Employee
If that's the cipher string in the SERVERHELLO message, then you are indeed doing an RSA key exchange. So then I guess the next question is how are you doing the SSLDUMP? You have to start capturing at the beginning of a new SSL session, as a resumption or renegotiation will be encrypted with keys that you won't have. Try this:
ssldump -AdNn -i [VLAN or interface] -k [path to private key] port 443 [and any additional filters]Does the private key require a passphrase? Do you get an error when you try to capture, or just not see any plaintext?
- Kevin_Stewart
Employee
You can force the F5 to use specific ciphers in the Ciphers block of the client SSL profile. Try this:
AES128-SHA256 - Kevin_Stewart
Employee
Okay, so a few things:
-
I'm assuming you did, but asking to make sure, did you substitute the bracketed values in that command with real values? Here's another example:
ssldump -AdNn -i 0.0 -k mykey.key port 443 -
As I mentioned earlier, you have to get in front of a new SSL session. Renegotiations and resumptions will be encrypted with a symmetric key that you won't have.
-
The private key you're using here has to be the same one you're using in the client SSL profile, which I'm also assuming is RSA-based.
-
- Kevin_Stewart
Employee
Okay, try one more thing. Copy that private key to a local file and see what happens.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
