How to DECRYPT HTTPS Traffic with Wireshark

In this tutorial, we are going to capture the client side session keys by setting an environment variable in Windows, then feed them to Wireshark for TLS 1.3 decryption.

Follow along with me by downloading the trace file and keylog file here:

Steps to capture client session key:
Open Control Panel:System
Select Advanced System Settings
Select Environment Variables
Add a new variable: SSLKEYLOG
Save to a location with a name ending in *.log
Restart Chrome (You may have to reboot Windows in some cases)
Capture Traffic
Add the keylog file to the TLS Protocol in Wireshark Preferences.

If you liked this video, I’d really appreciate you giving me a like and subscribing, it helps me a whole lot. Also don't be shy, chat it up in the comments!

== More On-Demand Training from Chris ==

== Live Wireshark Training ==

== Private Wireshark Training ==

[ganeshid]

Thanks as always Chris... really useful 🙏

[numberiforgot]

Even after all the experience I have with IT security/forensics, I’m still learning something new every day.

[NovakGoran]

'Packet heads' cracked me up. Thanks for the vid!

[alexmook]

Chris is a gem...I have learned so much from him over the years, especially on Pluralsight.

[maliki]

i havent touched cybersecurity in over a year but bet your ass stumbling on this video made me turn my PC back on, thank you for the insanely ez lesson

[scottspa]

I just experimented with this in a ucertify virtual lab I had open for a class assignment, and it was super easy and fun. Thank you for showing this !

[techanalogies]

A really interesting video indeed!...Learnt many new things....Could you make a video to learn how I can capture and decrypt my smartphone's browsing traffic using wireshark?(Both connected to the same networks)

[alexandermayerkirstein]

Remarkably excellent delivery style. Super efficient clarity. Nothing superfluous. Conceptual through point and click guidance. Compellingly engaging with constant forward quick-step momentum. Not too loud not soft spoken. Knowledgeable, conservative, passionate, trustworthy source. Technoratically enjoyable. First video I watched on this channel. Heading to check your other content for more of the same. Thank you!

[ryankan]

Hi Chris, so sorry, after I tried to save the SSL Key log file, I cannot find the file at all, for some reason. I am the administrator but I just cannot find it. Is there anything I must do? Thanks!

[moinvohra]

Can somebody help me?
I am not able to capture the log file even though I created an environment variable with the ssl.log in the end.

[Letraveler_rd]

I'm loading the file to Wireshark, but some reason the decryption is not working. I'm using a windows machine.

[ductran]

Thank you for sharing! Now I can understand ssl/tls handshake clearly and how https works. Love it and Subscribed.

[thatpigeondude]

finally... a video that works. I can't thank you enough dad.

[KaySwiss]

Glad you did the Collab with Bombal so I could find your content!

[bikupothen]

how did u get that SYSLOG file in the beginning?

[seantierney]

Fantastic guide! I don't normally comment, but you need to know that you are doing fantastic work! I am experiencing Wireshark for the very first time in a CTF and this was clear, informative, and helpful!

[TheDyingFox]

Nice to read online that this method apparently works the same with the Firefox web browser :D

[joshsalmon]

Im so confused. The file that you gave wireshark is completely different from the sslkeylog file that you made earlier. How did you create the file that you gave wireshark?

[sammyrajoy]

Thank you for this video Chris, I was following the WCNA study guide book but got stuck when I didnt see what's in the book(HTTP). I realised the time gap between the date of book publishing and the current version of wireshark. So switched my trail to 443 and TLS. This video helped me decrypt my session.

[mattdonnelly]

Don't tell me this isn't the same guy as Darknet Diaries. The voice is IDENTICAL.