How can I dump and decrypt HTTPS traffic from the command line under linux?

Question

I have a web application that I need to debug because I suspect that the request send is altered on its way to the server.

I want to dump the HTTPS traffic received on port localhost:443 and decrypt it so I can check the packages.

Obviously I do have the private hey from the server.

Is there a way to do this from the command line?

Answer 1

You can use ssldump.(it works on top of libpcap).

ssldump -r <File_Name>.pcap -k <Key_File>.key -d host <IP_Address>

You specify the following options with the ssldump utility:

-r: Read data from the <File_Name>.pcap file instead of from the network.
-k: Use <Key_File>.key file as the location for the SSL keyfile.
-d: Display the application data traffic.

You may refer the complete example here

Answer 2

You can import the SSL key in wireshark to decrypt https if Wireshark is compiled with SSL decryption support:

http://www.etherlook.com/howto/use-wireshark-to-decrypt-https/

http://wiki.wireshark.org/SSL