Wireshark captures and decrypts HTTPS encrypted packets

First, you must have a certificate in. pem format.

Windows certificates are exported from the. pfx file. This format can also be used on the official website, but I still failed to try it n times.

Finally, only. pfx can be converted to. pem format.

My Wireshark version is 1.4.4 and Winpcap version is 4.1.2.

First, convert. pfx to. pem.

1. Download OpenSSL.

2. Export the certificate. Here I export it to D:/test. pfx.

3. pfx to PEM

Syntax:

Openssl.exe PKCS12-in <drive:/path/to/Cert>. pfx-nodes-out <drive:/path/to/New/Cert>. pem 

I converted it like this:OpenSSL PKCS12-in D:/test. pfx-nodes-out d:/test. pem 

Open test. PEM and delete it to only

----- Begin RSA private key ----- <br/> examples + hray1_3ckpea2eqskiryg <br/> examples/mkuktpiz + examples + 8yf9teqe <br/> examples + qn6ddqidaqab <br/> examples/Examples <br/> signature + wupjxt7m + jmidrgltyjegh + bkgdmnsav <br/> Rs + signature/<br/> signature/Signature/<br/> bvtj7yevnxavabbwtvllojl + signature <br/> ggjkgmr/dorfu/logs/SK/th4ukrhyr5jyaqjan5tf <br/> logs/downloads <br/> logs <br/> geq15ybhenqm7ppc + logs = <br/> ----- end RSA private Key ----- 

Save.

 

Set it in Wireshark's edit --> prefferenct --> protocols --> SSL.

Then, capture the packet and find the Protocol package of tlsv1. Right-click follow SSL stream and then OK.