From the System tab, select Advanced System Settings. Today, we will walk through the steps necessary to instruct Google Chrome to write a special logfile containing the DH Pre-Master key which will allow Wireshark to decrypt the conversation from the client’s perspective.

As PFS is mandated by TLS 1.3, it’s time for those of us who are used to temporarily disabling DH ciphers to learn a new technique. Perfect forward secrecy (PFS) thwarts Wireshark’s ability to decrypt the data after the fact, even with access to the server’s private key.

The exception to this, is if the cipher agreed upon between client and server leverages Diffie-Hellman. What about messages sent later, encrypted over that secure tunnel? By providing Wireshark with the server’s private key, most of the time we can decrypt this traffic as well, right from within the Wireshark interface. The SSL/TLS handshake by necessity happens in the clear – you can’t send encrypted communication until that channel has been forged. Where is that failure occurring? Do the client and server have a version of TLS in common which they both support? Is there at least one cipher they can agree on? By looking at the SSL/TLS handshake taking place, you can see exactly where communication is breaking down.

Have you ever gotten an error message complaining about secure negotiation? Most Sysadmins have. When troubleshooting issues with SSL/TLS, Wireshark is invaluable.

When an application’s logs come up empty, Wireshark is often the best way to figure out what’s going with software. Wireshark is an extremely powerful tool for analyzing the conversations your computer is having over the network.

Wireshark certificate decrypt