(Please forgive and correct my inaccurate terminology, as I am not a security expert.)
Wireshark is not decrypting my SMTP / POP / IMAP traffic, and I think it is because the "Cipher Suite" is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, which I believe is Diffie-Hellman?
Here's what I have in my setup:
- I have access to both the email client (Outlook) and the server
- I am running Wireshark on the server
- I have the certificate (CSR, certificate, PFX, and RSA private key)
- I believe I have configured Wireshark correctly as far as loading in the PEM. The Wireshark debug log says
ssl_init private key file ...rsa-private-key-for-wireshark.pem successfully loaded.
But when I do a packet capture, I do not see decrypted data in the debug log, nor do I see decrypted data in the GUI.
After googling around, I suspect the issue is that DHE is used instead of "plain" RSA? But I don't know what my next steps should be. In my scenario, is there a way to capture this traffic?
Aucun commentaire:
Enregistrer un commentaire