Decrypt HTTPS Traffic in Wireshark Without a Private Key

Decrypt HTTPS Traffic

When you capture HTTPS packets in Wireshark, you only see encrypted TLS data. Without the website’s private key, the usual RSA decryption method will not work. But we can still decrypt HTTPS traffic in Wireshark without a private key. In this guide, I will show you how by using a browser feature known as SSLKEYLOGFILE and a complete lab setup in Kali Linux.

Why Is HTTPS Traffic Encrypted in Wireshark

HTTPS relies on TLS, standing for Transport Layer Security, to secure the information transferred from the browser to the web page. In case of capturing HTTPS data packets with Wireshark, you may obtain network addresses, ports, TLS handshake details, and encrypted records. It is not possible to decrypt the information. To do so, Wireshark needs the TLS session secrets.

How HTTPS and TLS Encryption Work

HTTPS and TLS function collaboratively to provide security for web communications. Listed below are some aspects that explain the process.

• The browser establishes a connection with the server over TCP port 443 for HTTPS using HTTP/1.1 or HTTP/2.

• Then the TLS handshake starts; the browser and server negotiate security settings, including the TLS version and cryptographic algorithms.

• To verify the server’s authenticity and to build trust, the browser checks the certificate.

• TLS handshake creates cryptographic secrets used to derive the keys that protect application data. Modern TLS commonly uses ephemeral key exchange.

• Lastly, browser and server exchange protected HTTP data. Wireshark can decode it when it has the appropriate session secrets and the required packets.

Understand with the help of an example:

When you log in to a website, HTTPS safeguards your login information while they travel across the network. Without decryption secrets, Wireshark can’t display the password or other protected HTTP data.

What is SSLKEYLOGFILE and How Does it Enable TLS Decryption

SSLKEYLOGFILE is an environment variable that supported applications like Firefox use to specify where TLS session secrets should be saved or stored. Wireshark can read this key log file and use the relevant secrets to decrypt matching captured sessions. This method doesn’t break TLS encryption or require the website's private key. It works because the browser records secrets from its own TLS connections for debugging and analysis.

Tools You Need to Decrypt HTTPS Traffic 

You need these tools to decrypt HTTPS traffic.

• Kali Linux (Linux environment)

• Wireshark (to capture and inspect packets)

• Firefox (browser that supports TLS sessions)

• SSLKEYLOGFILE (stores TLS session secrets for Wireshark)

How to Configure SSLKEYLOGFILE for Wireshark 

• Close all the browsers completely before setting the environment variable.

• Open a terminal and run:

export SSLKEYLOGFILE="$HOME/sslkey.log"

This tells a supported browser where to save TLS session secrets.

• Create the key log file

Run:

touch "$SSLKEYLOGFILE"

chmod 600 "$SSLKEYLOGFILE"

This creates the file and restricts access to its owner. The file may remain empty until the browser writes secrets to it.

• Launch Firefox

From the same terminal, run the browser command available on your system: 

firefox-esr

If that command is unavailable, try firefox. Keep the terminal open and visit https://example.com/.

• Check the key log file. Run these commands in a terminal:

ls -l "$HOME/sslkey.log"

wc -l "$HOME/sslkey.log"

• Configure Wireshark

1. Open Wireshark.
2. Go to Edit > Preferences > Protocols > TLS.

3. Find (Pre)-Master-Secret log filename.

4. Select /home/kali/sslkey.log or browse to the file in your home directory.

• Click OK.
• Capture and verify traffic

1. Capture HTTPS traffic. Open Wireshark, select the network interface connected to the internet, and click Start. In Firefox, visit https://www.example.com/. Wait for the page to load, then return to Wireshark and stop the capture.

2. Verify TLS decryption. In Wireshark, select a packet from the website's connection and expand its protocol details. If decryption works, you may see decoded HTTP/2 or HTTP data. You can also try the http2 display filter to look for HTTP/2 packets.

Steps to Decrypt HTTPS Traffic in Wireshark 

• Open Wireshark and select the network interface carrying Firefox traffic.

• Start packet capture.

• Visit https://example.com/ in the configured Firefox browser.

• Enter tls in the Wireshark display filter bar.

• Inspect matching packets for decoded HTTP or HTTP/2 application data.

• Stop capturing and save the capture as a .pcapng file.

How Can Exposed TLS Session Secrets Create an Insider Threat 

The secrets file is a log file containing secret keys used to decrypt the encrypted traffic in the HTTPS recording logs. Access to this file by any unauthorised person will allow them to gain sensitive information, such as logins, session IDs, and personal messages from the matching traffic records. Furthermore, exposure of these secrets poses another security risk by allowing the person to misuse a session.

Ways to Protect TLS Session Secrets and Prevent Data Exposure 

To protect TLS session secrets and prevent data exposure-

• Use the keylog file like a password.

• Allow SSLKEYLOGFILE only for authorised troubleshooting sessions.

• Save the file in a directory with strict permissions.

Learning how to decrypt HTTPS traffic in Wireshark helps cybersecurity learners understand encrypted network sessions and investigate application-layer activity.