Decrypt ssl server

Forums Technical Forums
1

Hi everyone
Is it possible to decrypt ssl server profile?

I want to view data send from server to f5

2

Yes, it is possible. If you’re on version 15 or higher, you can follow the instructions in the below F5 article:

Because you stated that you want to decrypt the traffic on the server-side (i.e. between the BIG-IP and the back-end pool member), you will need to use the “p” flag in your tcpdump command (this is mentioned in the same article).

An example of the command that I personally most often use is:

tcpdump -i <VLAN>:p -nn -s0  --f5 ssl "host <CLIENT IP> and port 443" -w /var/tmp/"$HOSTNAME"_"$(date +%d-%m-%y)".pcap

3

You can use my script: GitHub - JuergenMang/f5-tls-decrypt: Creates the Pre Master Secret File from tcpdump with enabled f5 sslprovider to decrypt TLS encrypted traffic with Wireshark · GitHub