lundi 22 décembre 2014

How to use Wireshark to capture SSL+DHE encrypted mail traffic (SMTP/POP/IMAP)



(Please forgive and correct my inaccurate terminology, as I am not a security expert.)


Wireshark is not decrypting my SMTP / POP / IMAP traffic, and I think it is because the "Cipher Suite" is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, which I believe is Diffie-Hellman?


Here's what I have in my setup:



  • I have access to both the email client (Outlook) and the server

  • I am running Wireshark on the server

  • I have the certificate (CSR, certificate, PFX, and RSA private key)

  • I believe I have configured Wireshark correctly as far as loading in the PEM. The Wireshark debug log says ssl_init private key file ...rsa-private-key-for-wireshark.pem successfully loaded.


But when I do a packet capture, I do not see decrypted data in the debug log, nor do I see decrypted data in the GUI.


After googling around, I suspect the issue is that DHE is used instead of "plain" RSA? But I don't know what my next steps should be. In my scenario, is there a way to capture this traffic?





Aucun commentaire:

Enregistrer un commentaire