{"id":2036,"date":"2014-04-10T10:33:49","date_gmt":"2014-04-10T09:33:49","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=2036"},"modified":"2014-04-10T11:33:26","modified_gmt":"2014-04-10T10:33:26","slug":"how-to-export-the-ssl-certificate-from-a-wireshark-packet-capture","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=2036","title":{"rendered":"How to export the SSL certificate from a Wireshark packet capture"},"content":{"rendered":"

How to obtain the SSL certificate from a Wireshark packet capture:<\/p>\n

    \n
  1. From the Wireshark menu choose Edit > Preferences and ensure that “Allow subdissector to reassemble TCP streams” is ticked in the TCP protocol preferences<\/li>\n
  2. Find “Certificate, Server Hello” (or Client Hello if it is a client-side certificate that you are interested in obtaining.<\/li>\n
  3. In the packet detail pane, expand the Secure Sockets Layer protocol<\/li>\n
  4. Expand the “TLSv1 Record Layer: Handshake Protocol: Certificate” field<\/li>\n
  5. Expand the “Handshake Protocol: Certificate” field<\/li>\n
  6. Expand the list of certificates. There may be one or more certificates depending upon whether a chain of trust is present. The first certificate is the server certificate, the second is the signing Certificate Authority, the third the CA that trusted\/signed that Certificate Authority and so on.<\/li>\n
  7. Right-click on the on the certificate that you wish to obtain then choose “Export selected packet bytes…” and name the file with a .der extension.<\/li>\n<\/ol>\n

    The file contains the certificate in DER format. Openssl can be used to view the certificate:<\/p>\n

    C:\\openssl\\bin>openssl x509 -in certs\\www.servername.com.der -inform der -text -noout<\/p><\/blockquote>\n

    See This Post for more examples of OpenSSL and certificate encoding types. http:\/\/darenmatthews.com\/blog\/?p=1299<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    How to obtain the SSL certificate from a Wireshark packet capture:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[71],"tags":[37],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2036"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2036"}],"version-history":[{"count":4,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2036\/revisions"}],"predecessor-version":[{"id":2040,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2036\/revisions\/2040"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2036"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}