My main point in writing this post is to present you the steps of the TLS communication. Finally the client was using a slightly outdated browser which supports TLS 1.0 (though I will inform you what would have been different if it had been TLS 1.2) and does not use ephemeral keys. Let’s then assume that your server has a certificate with a public RSA key and you are in possession of its private key. The client forgot to copy the error message but luckily had a Wireshark instance running in the background (I know it’s highly hypothetical, but just close your eyes to that :)) and he/she sent you the collected traces.

pcap file recorded by one of your company clients who complains that your application returned 500 HTTP status code with a strange error message. Today I would like to show you the steps required to decrypt a sample HTTPS request. I wanted to know what makes it secure and how the communication actually looks like.

Recently I have spent some time on learning the internals of HTTPS.

Wireshark https ssl pem