topic streamfwd SSL decryption:session keys not found in Security

streamfwd SSL decryption:session keys not found

alviszhang — Mon, 14 Nov 2016 09:56:07 GMT

I am trying to decrypt https traffic (using RSA chipher) :
1, add the private key

./streamfwd --addsslkey test /tmp/server.key

2, add 2 lines into streamfwd.conf

sslServer.0.address = 10.1.1.98
sslServer.0.port = 443

but WARN found in streamfwd.log
access site with Chrome

2016-11-14 18:50:56 WARN  [139823066740480] (SnifferReactor/PacketProcessor.cpp:515) stream.SnifferReactor - SSL decryption error (TLS session ticket not cached - did not capture the original SSL session?) (ssl) [c=10.1.20.29:2381, s=10.1.1.98:443]

access site with IE

2016-11-14 18:50:57 WARN  [139823066740480] (SnifferReactor/PacketProcessor.cpp:515) stream.SnifferReactor - SSL decryption error (session keys not found - did not capture beginning of SSL session?) (ssl) [c=10.1.20.29:2385, s=10.1.1.98:443]

Anyone can help?
Thanks

Re: streamfwd SSL decryption:session keys not found

vshcherbakov_sp — Mon, 14 Nov 2016 23:34:05 GMT

Hi @alviszhang,

tl;dr: usually you need to fully restart the browsers (as in terminating the chrome/IE/etc. processes, not just closing the window(s))

TLS standard provides ways for faster renegotiation of the subsequent SSL sessions between the same client/server pair using parts of the original session's state. If Stream caches this information, it can decrypt the subsequent renegotiations; however if this information was exchanged before Stream started listening to the traffic, there's nothing much Stream (or any other tool for that matter) can do do decrypt the session.

Re: streamfwd SSL decryption:session keys not found

alviszhang — Tue, 15 Nov 2016 06:31:42 GMT

Thanks very much!