Security

streamfwd SSL decryption:session keys not found

alviszhang
New Member

I am trying to decrypt https traffic (using RSA chipher) :
1, add the private key

./streamfwd --addsslkey test /tmp/server.key

2, add 2 lines into streamfwd.conf

sslServer.0.address = 10.1.1.98
sslServer.0.port = 443

but WARN found in streamfwd.log
access site with Chrome

2016-11-14 18:50:56 WARN  [139823066740480] (SnifferReactor/PacketProcessor.cpp:515) stream.SnifferReactor - SSL decryption error (TLS session ticket not cached - did not capture the original SSL session?) (ssl) [c=10.1.20.29:2381, s=10.1.1.98:443]

access site with IE

2016-11-14 18:50:57 WARN  [139823066740480] (SnifferReactor/PacketProcessor.cpp:515) stream.SnifferReactor - SSL decryption error (session keys not found - did not capture beginning of SSL session?) (ssl) [c=10.1.20.29:2385, s=10.1.1.98:443]

Anyone can help?
Thanks

0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi @alviszhang,

tl;dr: usually you need to fully restart the browsers (as in terminating the chrome/IE/etc. processes, not just closing the window(s))

TLS standard provides ways for faster renegotiation of the subsequent SSL sessions between the same client/server pair using parts of the original session's state. If Stream caches this information, it can decrypt the subsequent renegotiations; however if this information was exchanged before Stream started listening to the traffic, there's nothing much Stream (or any other tool for that matter) can do do decrypt the session.

View solution in original post

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi @alviszhang,

tl;dr: usually you need to fully restart the browsers (as in terminating the chrome/IE/etc. processes, not just closing the window(s))

TLS standard provides ways for faster renegotiation of the subsequent SSL sessions between the same client/server pair using parts of the original session's state. If Stream caches this information, it can decrypt the subsequent renegotiations; however if this information was exchanged before Stream started listening to the traffic, there's nothing much Stream (or any other tool for that matter) can do do decrypt the session.

0 Karma

alviszhang
New Member

Thanks very much!

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...