0
I am trying to develop a test tool to validate a SOAP-based protocol that is served over HTTPS.
My problem is that if I have any issue in the protocol, I cannot use wireshark to debug it, because the traffic is encrypted.
Is it possible to generate with openssl a certificate that has a nihil cyper?
Ottavio Campana
Posted 2017-05-02T06:45:55.797
Reputation: 166
3
The TLS ciphersuite selected (which may use NULL encryption) is independent from the certificate used, i.e. just use a normal certificate with one of the "WITH_NULL" ciphersuites:
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4
Another alternative is to configure wireshark to decrypt the traffic (this requires wireshark to have access to the private key):
Matt Caswell
Posted 2017-05-02T06:45:55.797
Reputation: 221
Decrpytion in wireshark only works, if you disable all ciphersuites which use Diffie-Hellman key exchange. – mat – 2017-05-04T10:41:20.340
0
Yes and no.
Yes: X.509 certificates almost always have either a keyUsage or a extendedKeyUsage extension, which regulates how the certificate is to be used. If you ommit the values dataEncipherment and keyEncipherment at this point and set it to something else (like digitalSignature) , every application adhering to the standard must not use the certificate's key for encryption.
No: Every X.509 certificate contains a public key which can theoretically be used to encrypt data, no matter what the standard orders you to do.
Bottom line: You can not technically prohibit someone from doing encryption with a key in a X.509 certificate. Your best shot is to set the keyUsage to a appropriate value and to use an ECC key instead of an RSA key, since ECC encryption is something that is not done very often.
mat
Posted 2017-05-02T06:45:55.797
Reputation: 467
As another answer pointed out, RSA is not (normally) used for encryption in SSL. Instead RSA is used for authentication in SSL. So the certificate attributes don't play a role in the encryption algorithm used in an SSL session. – Χpẘ – 2017-05-03T16:13:58.280
@Χpẘ Not neccesarily. There are cipher suites which use the RSA key of the server for an encrypted key exchange (instead of DH). – mat – 2017-05-04T10:42:12.940
But that's still not using RSA to encrypt the payloads, which is what the OP is asking about. – Χpẘ – 2017-05-04T15:57:25.470
Is he? That's not how I read the question. But it is not stated very clear. – mat – 2017-05-04T18:04:12.573
The way I read it is that he wants to view the decrypted traffic via Wireshark. (The other answer seems to have the same interpretation I do.) I think OP misunderstands the role the certificate plays in establishing an SSL session - hence his question about certificate attributes. BTW, it is interesting to know that RSA can be used for key exchange – Χpẘ – 2017-05-04T18:14:12.860
Before Snowden, that was even the most common way to do the key exchange. TLS 1.3 will drop that possibility, though. – mat – 2017-05-04T22:04:04.537
There are protocol analysis programs that act as proxies. They allow you to view unencrypted HTTPS traffic. A couple of them are Fiddler and Burp Suite. I've used Fiddler before and it works fine. Separately Chrome and Firefox support the SSLKEYLOGFILE environment variable, which writes the SSL session key to a file, which Wireshark can consume. I'm guessing a browser is not the client endpoint of your SOAP protocol, so you couldn't use this directly. You could however implement the same support in your endpoint (if you can build the endpoint) – Χpẘ – 2017-05-03T16:27:17.203