Skip to main content
lestopace
Staff
lestopace
Staff
August 19, 2022

Technical Tip: Extracting certificates from SSL/TLS handshake packet capture

  • August 19, 2022
  • 0 replies
  • 9168 views
Description This article describes how to extract certificates from SSL/TLS handshake(i.e. https, eap-tls negotiation, etc) packet capture using Wireshark.
Scope FortiGate.
Solution
  1. Start capture and enable filters in GUI -> Network -> Packet Capture.

 

lestopace_2-1660897435280.png

 

  1. Download the capture and open it on Wireshark.
  2. In the Wireshark filter box, use the filter: tls.handshake.type eq 11

This will filter all packets that contain the certificate. Additionally, one might need to add a specific destination IP among the others.

 

lestopace_3-1660897880217.png

 

  1. Select the packet that contains the certificate that needs to be downloaded, and Select Transport Layer Security -> TLSv1.X Record Layer -> Handshake Protocol: Certificates -> Certificate > signedCertificate > issuer: rdnSequence. 

 

lestopace_4-1660898037511.png

 

  1. 'Right-click' on the Certificate that needs to be downloaded, then select 'Export Packet Bytes'.

 

lestopace_5-1660898186427.png

 

  1. Select the desired folder location, set the file name with .cer or .crt file extension, and make sure that the type is set as All Files.

 

lestopace_6-1660898318258.png

 

  1. Extracting the certificate from a pcap file is completed now.

 

lestopace_7-1660898615802.png

  lestopace_8-1660898629476.png

 

Sample from eap-tls over radius capture:

 

lestopace_1-1660956889341.png

 

Note: In TLS 1.3, certificates are encrypted during the handshake and cannot be extracted with this method. See this article for more information: TLS 1.3: An Overview of Benefits and Risks.
    Terms & ConditionsAccessibility statement