Technical Tip: Extracting certificates from SSL/TLS handshake packet capture

[lestopace]

Description	This article describes how to extract certificates from SSL/TLS handshake(i.e. https, eap-tls negotiation, etc) packet capture using Wireshark.
Scope	FortiGate.
Solution	Start capture and enable filters in GUI -> Network -> Packet Capture. Download the capture and open it on Wireshark. In the Wireshark filter box, use the filter: tls.handshake.type eq 11 This will filter all packets that contain the certificate. Additionally, one might need to add a specific destination IP among the others. Select the packet that contains the certificate that needs to be downloaded, and Select Transport Layer Security -> TLSv1.X Record Layer -> Handshake Protocol: Certificates -> Certificate > signedCertificate > issuer: rdnSequence.  'Right-click' on the Certificate that needs to be downloaded, then select 'Export Packet Bytes'. Select the desired folder location, set the file name with .cer or .crt file extension, and make sure that the type is set as All Files. Extracting the certificate from a pcap file is completed now.   Sample from eap-tls over radius capture: Note: In TLS 1.3, certificates are encrypted during the handshake and cannot be extracted with this method. See this article for more information: TLS 1.3: An Overview of Benefits and Risks.