Menu
I am trying to debug SSL Encrypted Alerts on my web server. I am not sure what the problem is and things appear to be working, but I am seeing many TLSv1 Encrypted Alerts in Wireshark that I feel should not be there.
The TLSv1 alert protocol (http://en.wikipedia.org/wiki/Transport_Layer_Security#Alert_protocol) provides error codes indicating what is wrong, unfortunately this code is encrypted.
Wireshark allows the SSL to be decrypted by providing the private key (which I have) in the SSL preferences page. However this does not work for me due to the session being setup with Ephemeral RSA (Sharkfest'09 http://sharkfest.wireshark.org/sharkfest.12/presentations/MB-1_SSL_Troubleshooting_with%20_Wireshark_Software.pdf page 59).
I want to know how I can read this alert code. Any of the following will get me there:
a) Have Wireshark decrypt SSL using Ephemeral RSA
b) Avoid using Ephemeral RSA so Wireshark can decrypt
c) Force the SSL to use null encryption so I can just read the code to debug it
320
Using TLS decryption, enterprises can decrypt and perform deep packet inspection on the traffic moving through their enterprise. The main limitation of TLS decryption in Wireshark is that it requires the monitoring appliance to have access to the secrets used for encryption.
A TLS handshake is the process that kicks off a communication session that uses TLS. During a TLS handshake, the two communicating sides exchange messages to acknowledge each other, verify each other, establish the cryptographic algorithms they will use, and agree on session keys.
"Encrypted Alert" means Wireshark can't decrypt it. The reason why this packet appears may vary, but if it appears just before a TCP FIN, it is usually a "close_notify". You would need to decrypt the packet for Wireshark to show the Close Notify.
b) Avoid using Ephemeral RSA so Wireshark can decrypt
If you web server is Apache, try the following:
httpd.conf
SSLProtocol +all -SSLv2 -SSLv3
SSLCipherSuite -kEECDH:-kEDH:+kRSA:+HIGH:+MEDIUM:-LOW:-EXP
c) Force the SSL to use null encryption so I can just read the code to debug it
This might be a little trickier, but try moving eNULL to the front of the list. eNULL will probably be rejected by the client, but its worth a try. I suspect it will be rejected because the client won't allow the cipher (or aNULL, for that matter).
If the client does have eNULL, it still might not be used. The server usually honors the client's ciphers, so unless the client requests eNull, then you will have to find an override on the server configuration.
161
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
