Technical Tip: Decrypt HTTPS traffic with Wireshark

[Dhruvin_patel]

Description	This article describes how to decrypt the HTTPS traffic on the client using Wireshark. While using virtual servers on FortiGate, it is sometimes necessary to decrypt the traffic on the client end to isolate the issue further.
Scope	Windows Client, FortiGate.
Solution	Ensure that the client has the necessary permissions to capture the traffic and has Wireshark installed on the client's Windows machine to capture the traffic. Capture the client side of the session key. Close Chrome completely, and make sure all the instances are closed. Verify from the task manager that all the instances are closed. Open Control Panel -> User Accounts -> User Accounts. On the left, 'Change my environment variables.', Select 'New' on the user variables section.                                   Variable name: SSLKEYLOGFILE. Variable value: %USERPROFILE%\Desktop\sslkey.log. Start Wireshark, and start capturing packets on the Internet interface. Open Chrome and verify that the sslkey.log file has been created. Open the website to decrypt. In this example, it is tested with the website '123.net'. Verify that the packets are being captured on Wireshark. On Wireshark, go to Edit -> Preferences -> Protocols, and select TLS. Under (Pre)-Master-Secret log filename, select the sslkey.log file from the PC where it has been stored, and then select 'OK'. The decrypted packet is now observed in Wireshark. The steps may change when Windows or Chrome gets updated. The same steps should be valid for other internet browsers like Firefox. Setting SSLKEYLOGFILE as a User Environment Variable causes all applications that support SSLKEYLOGFILE to log TLS keys if they are started after the variable is set, regardless of whether they are launched via GUI or CLI. This caused unnecessary SSL key logging and may be a security concern. An alternative to this is the CLI-scoped method. Logs TLS session keys only for applications started from a particular CMD CLI. Go to Windows CMD CLI : Make a folder for logging SSL keys  > mkdir C:\chromeTLS                Set the SSLKEYLOGFILE to the file path where the keys will be logged. The SSLKEYLOGFILE setting is local to this CMD window. > set SSLKEYLOGFILE=C:\chromeTLS \tls_keys.log Verify the SSLKEYLOGFILE location. > echo %SSLKEYLOGFILE% Launch Chrome or any other browser from this CMD window. > "C:\Program Files\Google\Chrome\Application\chrome.exe" The TLS keys for the HTTPS traffic in this particular browser instance will be logged to tls_keys.log. A browser launched from the Start Menu or taskbar will not log keys. TLS keys for other browsers/applications will not be logged. Use the same method described earlier in the KB article to import the TLS keys (tls_keys.log) in Wireshark to decrypt the traffic.