-
-
Notifications
You must be signed in to change notification settings - Fork 35.6k
Optionally log master secrets for TLS connectionsΒ #2363
Copy link
Copy link
Closed
Labels
feature requestIssues that request new features to be added to Node.js.Issues that request new features to be added to Node.js.securityIssues and PRs related to security.Issues and PRs related to security.tlsIssues and PRs related to the tls subsystem.Issues and PRs related to the tls subsystem.
Metadata
Metadata
Assignees
Labels
feature requestIssues that request new features to be added to Node.js.Issues that request new features to be added to Node.js.securityIssues and PRs related to security.Issues and PRs related to security.tlsIssues and PRs related to the tls subsystem.Issues and PRs related to the tls subsystem.
Type
Fields
Give feedbackNo fields configured for issues without a type.
Sometimes it's necessary to decrypt your own TLS connections to debug their contents. Wireshark supports this quite nicely with its decryption feature. For non-DH key agreement, you simply provide the private key of the server. However, for DH key agreement, or when you are acting only as a client, that doesn't work. Firefox and Chrome support the environment variable SSLKEYLOGFILE to write the master secrets used to a file, for decryption by Wireshark. It would be great to support this or a similar mechanism for logging master secrets in Node.
Key log format: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format
Helpful Stack Exchange howto: https://security.stackexchange.com/questions/35639/decrypting-tls-in-wireshark-when-using-dhe-rsa-ciphersuites/42350#42350
Wireshark decryption docs: https://wiki.wireshark.org/SSL
(reposted from nodejs/node-convergence-archive#59).