Decrypting SSL/TLS browser traffic with Wireshark (using netsh trace start)

Walk-through on how to use built-in Windows netsh tool to capture https browser network traffic, convert it using etl2pcapng, and then afterwards decrypt it with Wireshark.

To do this we use SSLKEYLOGFILE and the netsh command line to create a network trace and TLS session keys.

Sorry, audio seems to have some hiccups - but hopefully not too bad.

Microsoft's ETL to pcap conversion tool is here:

Intro 0:00
Capture TLS session keys via SSLKEYLOGFILE 0:10
Use netsh trace to capture traffic on Windows 0:30
Convert etl file to pcap using etl2pcapng 1:40
Decrypting the pcap using the capture TLS session keys 2:50
Wrap-up 3:20

[mortenwormdue]

Only works, if the traffic comes from the browser - in your example, chrome provides the session keys.
So, no - not really workable on a server.

[bratecyo]

wireshark's team need to integrate converter etLtoPcapng in their product

[itamarcohen]

What is that key file? how do i create it and use it?
I created it from scratch but after doing the commands it has 0 length

[shibbyshaggy]

Didn't work on Windows 10 running Chrome. Followed all your steps, it created the files just fine, i converted to pcap and when trying to decrypt in wireshark using the keys file it didn't work. anything special between your windows version and/or Chrome?

[Sway]

how to do it for traffic outside of browser? say I have a desktop app

[RandomAccess]

[Environment]::SetEnvironmentVariable("SSLKEYLOGFILE", "c:\temp\sslkeys\keys", "MACHINE")

netsh trace start capture=yes report=disabled

netsh trace stop

[geeksified]

won't decrypt credentials to plain text, correct?