Security

streamfwd SSL decryption:session keys not found

New Member

I am trying to decrypt https traffic (using RSA chipher) :
1, add the private key

./streamfwd --addsslkey test /tmp/server.key

2, add 2 lines into streamfwd.conf

sslServer.0.address = 10.1.1.98
sslServer.0.port = 443

but WARN found in streamfwd.log
access site with Chrome

2016-11-14 18:50:56 WARN  [139823066740480] (SnifferReactor/PacketProcessor.cpp:515) stream.SnifferReactor - SSL decryption error (TLS session ticket not cached - did not capture the original SSL session?) (ssl) [c=10.1.20.29:2381, s=10.1.1.98:443]

access site with IE

2016-11-14 18:50:57 WARN  [139823066740480] (SnifferReactor/PacketProcessor.cpp:515) stream.SnifferReactor - SSL decryption error (session keys not found - did not capture beginning of SSL session?) (ssl) [c=10.1.20.29:2385, s=10.1.1.98:443]

Anyone can help?
Thanks

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi @alviszhang,

tl;dr: usually you need to fully restart the browsers (as in terminating the chrome/IE/etc. processes, not just closing the window(s))

TLS standard provides ways for faster renegotiation of the subsequent SSL sessions between the same client/server pair using parts of the original session's state. If Stream caches this information, it can decrypt the subsequent renegotiations; however if this information was exchanged before Stream started listening to the traffic, there's nothing much Stream (or any other tool for that matter) can do do decrypt the session.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Hi @alviszhang,

tl;dr: usually you need to fully restart the browsers (as in terminating the chrome/IE/etc. processes, not just closing the window(s))

TLS standard provides ways for faster renegotiation of the subsequent SSL sessions between the same client/server pair using parts of the original session's state. If Stream caches this information, it can decrypt the subsequent renegotiations; however if this information was exchanged before Stream started listening to the traffic, there's nothing much Stream (or any other tool for that matter) can do do decrypt the session.

View solution in original post

0 Karma

New Member

Thanks very much!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!