Wireshark Decryption of TLS V1.2

user_9698435 0
Viewed 13902

i have traffic between clients (which send XML over https) to my IIS. i tried to decrypt the traffic using wire shark and the next settings : add the Private Key : enter image description here

but even after setting this i see can't see the decrypted data : enter image description here

should i do any other settings to see the original data?

tls1.2 wireshark encryption ssl
1 Answers

There is strong possibility that a Diffie-Hellman (DH) key exchange is being used here. In that case Wireshark cannot decipher SSL/TLs with a private key. You can check for this in the handshake packet.

From the Docs:

The RSA private key file can only be used in the following
circumstances:

  • The cipher suite selected by the server is not using (EC)DHE.
  • The protocol version is SSLv3, (D)TLS 1.0-1.2. It does not work with TLS 1.3.
  • The private key matches the server certificate. It does not work with the client certificate, nor the Certificate Authority (CA)
    certificate.
  • The session has not been resumed. The handshake must include the ClientKeyExchange handshake message.
user_14696630
Related