Technical Tip: Extracting SSL Server certificate from PCAP file

[kwcheng__FTNT]

Description	This article describes how to extract an SSL server certificate from a PCAP file.
Scope	FortiGate.
Solution	Notes: The PCAP file must include the 'packet data'. Crosscheck the 'verbose' filter option when capturing the SSL handshake connection so that it includes the 'packet data'. In this example, verbose 6 is used. TLS 1.3 is not supported because it is by designed that TLS 1.3 will encrypt the server certificate. For more information, you can refer to the following link: TLS 1.3: An Overview of Benefits and Risks. The sample website used here will be 'https://badssl.com/'. Make sure Wireshark software is installed. The following are the steps to extract the SSL server certificate from a PCAP file: Locate the 'Server Hello' or the data packet which has the 'certificate'.     'Right-click' and select 'Export packet bytes'. Select type as 'All Files' and rename as 'YourCertName.der'.   Once it is successful, just open the .der file to check.