streamfwd SSL decryption:session keys not found

[alviszhang]

I am trying to decrypt https traffic (using RSA chipher) :
1, add the private key

./streamfwd --addsslkey test /tmp/server.key

2, add 2 lines into streamfwd.conf

sslServer.0.address = 10.1.1.98
sslServer.0.port = 443

but WARN found in streamfwd.log
access site with Chrome

2016-11-14 18:50:56 WARN  [139823066740480] (SnifferReactor/PacketProcessor.cpp:515) stream.SnifferReactor - SSL decryption error (TLS session ticket not cached - did not capture the original SSL session?) (ssl) [c=10.1.20.29:2381, s=10.1.1.98:443]

access site with IE

2016-11-14 18:50:57 WARN  [139823066740480] (SnifferReactor/PacketProcessor.cpp:515) stream.SnifferReactor - SSL decryption error (session keys not found - did not capture beginning of SSL session?) (ssl) [c=10.1.20.29:2385, s=10.1.1.98:443]

Anyone can help?
Thanks

[vshcherbakov_sp · Accepted solution]

Hi @alviszhang,

tl;dr: usually you need to fully restart the browsers (as in terminating the chrome/IE/etc. processes, not just closing the window(s))

TLS standard provides ways for faster renegotiation of the subsequent SSL sessions between the same client/server pair using parts of the original session's state. If Stream caches this information, it can decrypt the subsequent renegotiations; however if this information was exchanged before Stream started listening to the traffic, there's nothing much Stream (or any other tool for that matter) can do do decrypt the session.

[alviszhang]

Thanks very much!