It will be created automatically if the environment variable has been set, not all browsers might support it. Also see embracethered.com/blog/posts/2023/decrypt-wireshark-traffic-https-netsh/
Didn't work on Windows 10 running Chrome. Followed all your steps, it created the files just fine, i converted to pcap and when trying to decrypt in wireshark using the keys file it didn't work. anything special between your windows version and/or Chrome?
Thanks for the comment, and checking out my video. A possible reason might be that most browsers only pickup the environment variable on first start, so make sure to terminate all instances (e.g something like taskkill /im chrome.exe /f). More details here: embracethered.com/blog/posts/2023/decrypt-wireshark-traffic-https-netsh/
Only works, if the traffic comes from the browser - in your example, chrome provides the session keys.
So, no - not really workable on a server.
wireshark's team need to integrate converter etLtoPcapng in their product
What is that key file? how do i create it and use it?
I created it from scratch but after doing the commands it has 0 length
It will be created automatically if the environment variable has been set, not all browsers might support it. Also see embracethered.com/blog/posts/2023/decrypt-wireshark-traffic-https-netsh/
Didn't work on Windows 10 running Chrome. Followed all your steps, it created the files just fine, i converted to pcap and when trying to decrypt in wireshark using the keys file it didn't work. anything special between your windows version and/or Chrome?
Thanks for the comment, and checking out my video. A possible reason might be that most browsers only pickup the environment variable on first start, so make sure to terminate all instances (e.g something like taskkill /im chrome.exe /f). More details here: embracethered.com/blog/posts/2023/decrypt-wireshark-traffic-https-netsh/
how to do it for traffic outside of browser? say I have a desktop app
Appreciate the videos dude
Thanks for the comment! Really appreciate the note - knowing some find it useful def keeps the motivation high on creating more.
won't decrypt credentials to plain text, correct?
It decrypts the TLS browser traffic.
thankyou
You're welcome! Hope it was useful!
[Environment]::SetEnvironmentVariable("SSLKEYLOGFILE", "c:\temp\sslkeys\keys", "MACHINE")
netsh trace start capture=yes tracefile=c:\temp\sslkeys\trace.etl report=disabled
netsh trace stop