Search code examples
sslencryptionwiresharkmitmproxy

mitmproxy: SSL keys not decrypting in Wireshark

And I'm not sure why.

mitmproxy installed with pip on Kali Linux.

Run using $ SSLKEYLOGFILE="$PWD/.mitmproxy/sslkeylogfile.txt" mitmproxy as per https://docs.mitmproxy.org/master/howto-wireshark-tls/

Firefox using FoxyProxy with proxy to 127.0.0.1:8080. Certificate installed.

Wireshark configured to use sslkeylogfile.txt also as per above docs.

And then go.

mitmproxy sees traffic: mitmproxy

SSL key log file adds keys: sslkeylogfile

And Wireshark captures traffic, but nothing is decrypted: wireshark

As would be expected with successful SSL key usage https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-https-traffic/

What am I doing wrong?

Thanks

Solution

  • MitmProxy has at the moment an open issue that prevents writing a correct SSLKEYLOGFILE when TLS 1.3 is used.

    Therefore my recommendation would be to disable TLS 1.3 for connections from client to MitmProxy and for connections from MitmProxy to the server. This can be done using the following command-line options:

    --set ssl_version_server=TLSv1, TLSv1_1, TLSv1_2
--set ssl_version_client=TLSv1, TLSv1_1, TLSv1_2

    See also MitmProxy documentation: https://docs.mitmproxy.org/stable/concepts-options/

    Edit: According to the comments in the issue the problem with TLS1.3 should be solved since Mitmproxy version v6.0.0 (released Dec 13, 2020).