Technical Tip: Decrypt HTTPS traffic with Wireshark

[Dhruvin_patel]

Description	This article describes how to decrypt the HTTPS traffic on the client using Wireshark. While using virtual servers on FortiGate, it is sometimes necessary to decrypt the traffic on the client end to isolate the issue further.
Scope	Windows Client, FortiGate.
Solution	Ensure that the client has the necessary permissions to capture the traffic and has Wireshark installed on the client's Windows machine to capture the traffic. Capture the client side of the session key. Close Chrome completely, and make sure all the instances are closed. Verify from the task manager that all the instances are closed. Open Control Panel -> User Accounts -> User Accounts. On the left, 'Change my environment variables.', Select 'New' on the user variables section.                                   Variable name: SSLKEYLOGFILE. Variable value: %USERPROFILE%\Desktop\sslkey.log. Start Wireshark, and start capturing the packet capture on the Internet interface. Open Chrome and verify that the sslkey.log file has been created. Open the website that would like to decrypt. In this example, it is tested with the website '123.net'. Verify that the packets are being captured on Wireshark. On Wireshark, go to Edit -> Preferences -> Protocols, and select TLS. Under (Pre)-Master-Secret log filename, select the sslkey.log file from the PC where it has been stored, and then select 'OK'. The decrypted packet is now observed in Wireshark. The steps may change when Windows or Chrome gets updated. The same steps should be valid for other internet browsers like Firefox.