How do I decrypt TLS traffic for troubleshooting?

On a machine you control, the simplest way is to have the client write its session keys to a file and load that file into Wireshark. Browsers and many command-line tools built on OpenSSL or NSS honour the SSLKEYLOGFILE environment variable: set it, reproduce the problem while capturing with Wireshark or tcpdump, then point Wireshark's TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. settings to the key log. This also works for TLS 1.3, where having the server's private key is no longer enough. For a server you run, some web servers and proxies can log keys too, or you can test against a staging copy with logging turned on. Treat key logs like passwords: anyone with the file and the capture can read the traffic, so delete both afterwards, and never collect them from other people's devices without a clear basis and their knowledge. For everyday monitoring, decryption is rarely needed: flow metadata and the unencrypted handshake answer most questions about who talks to whom and how.

← All 40 questions on Encryption and encrypted trafficAll topics