How to decode SSL in case of HTTPS packets

I’m not sure this will help, but… the way firewalls do this (not Wireshark, but real Firewalls and IPSs) is that they proxy the SSL connection. So, THEY present the user with an SSL certificate (issued to the Firewall), the user accepts this certificate as coming FROM THE FIREWALL as a proxy. The Firewall then opens the SSL connection to the remote site.

The point here is that the user has to trust the firewall. The user has a secure encrypted connection to the firewall, and the firewall has a secure encrypted connection to the remote resource.

Peter
OSR


… the way firewalls do this

While yes, this scheme works, it is a classic ‘man-in-the-middle’ attack on
TLS/SSL and more sophisticated systems that perform the extra steps to
protect against it will detect the condition treat the connection with great
prejudice.

Firewalls operated by the entity providing the ‘server’ side of the equation
(the service provider) are often given access to the same
certificate/private-key used by the ‘server’ itself so it can perform this
deep inspection, etc. and yet still appear to the client as the actual
server (this is the trusted intermediary model). In this mode the firewall
is ‘part of’ the service overall and protecting the service (rarely the
client - it is untrusted and thus the whole reason to inspect the traffic).

But yes, if you can stage a MITM proxy and your client does not complain, it
works just fine. But no system really serious about security will (should)
tolerate it.

OP: Please, go learn about TLS. You are over your head and in serious
danger of drowning. Its reason for existence is to prevent what you are
trying to do. It will win. Even with its flaws it is way ahead. Your best
hope is to become smart about it and explain to your project advisor why it
cannot be done without certain allowances (like those already explained and
used by Wireshark, etc.) and demonstrate your mastery of the subject. You
are not helping your cause by insisting the impossible is possible.

Dave Cattley

What truly amazes me is that this thread somehow managed to grow, up to this moment, to 22 posts…

Let’s face it - the idiocy of “i am not able to see the HTTPS packets as these are SSL encrypted. How i will decrypt it.” (original spelling and grammar preserved) question is so incredibly profound that one would not normally expect to see any replies to it…

Anton Bassov

On 31-Jul-2013 03:08, xxxxx@hotmail.com wrote:

What truly amazes me is that this thread somehow managed to grow, up to this moment, to 22 posts…

That’s because we are, mostly, programmers :wink:

[quote] What really is the point of trying to teach anything to anybody?
… if you really want to understand something,
the best way is to try and explain it to someone else. That forces you
to sort it out in your mind. And the more slow and dim-witted your
pupil, the more you have to break things down into more and more simple
ideas. And that’s really the essence of programming. By the time you’ve
sorted out a complicated idea into little steps that even a stupid
machine can deal with, you’ve learned something about it yourself. [/quote]

http://en.wikiquote.org/wiki/Douglas_Adams

– pa

>

I’m not sure this will help, but… the way firewalls do this (not Wireshark, but
real Firewalls and IPSs) is that they proxy the SSL connection. So, THEY
present the user with an SSL certificate (issued to the Firewall), the user
accepts this certificate as coming FROM THE FIREWALL as a proxy. The
Firewall then opens the SSL connection to the remote site.

The point here is that the user has to trust the firewall. The user has a secure
encrypted connection to the firewall, and the firewall has a secure encrypted
connection to the remote resource.

You’ve surprised me Peter. I assumed the assistance you would provide once it was daylight in your timezone was going to be to lock this thread, so the rest of us could stop being anxious that someone is wrong on the internet http://xkcd.com/386/ :slight_smile:

James

> That’s because we are, mostly, programmers :wink:

Well, the quotation you have provided is just wonderful in itself - indeed, the best way to grasp some complex
concept is to try explaining it to someone else. However,do you really think that ANYONE on this thread (apart from the OP, of course) needs to explain to himself why decrypting encrypted data without a key is impossible??? Therefore, the above quotation does not seem to apply here…

Anton Bassov

PLEASE do not resurrect old, dead threads. That’s called “necroposting”, and it is forbidden here. This thread is 11 years old.

And the tread is locked.