TLS - Wireshark Wiki

Publisher

Wireshark Foundation

URL

https://wiki.wireshark.org/TLS

Published

unknown

Updated

unknown

Accessed

2026-09-23

HTTP status

200

License

Wireshark wiki content license not checked this run; no-redistribution; short excerpts and locators only

Source notes citing this source

• editcap --inject-secrets tls,<keyfile> embeds TLS secrets into a pcapng Decryption Secrets Block, so the capture decrypts without separately configuring the key log preference. in context
• Wireshark's key log file is configured at Edit > Preferences > Protocols > TLS > (Pre)-Master-Secret log filename. in context
• A TLS key log file (for example written through the SSLKEYLOGFILE environment variable) enables Wireshark to decrypt TLS even when a Diffie-Hellman key exchange is used. in context
• Wireshark's RSA private key method cannot decrypt TLS when the cipher suite uses (EC)DHE, when the protocol is TLS 1.3, when the key does not match the server certificate, or when the session was resumed without a ClientKeyExchange. in context
• Wireshark's RSA private key decryption works only with SSLv3 and TLS 1.0 to 1.2. in context
• The Wireshark wiki describes a key log file (SSLKEYLOGFILE-style per-session secrets) as a universal mechanism that enables decryption even when a Diffie-Hellman key exchange is used. in context
• Wireshark can decrypt TLS with the server's RSA private key only when the negotiated cipher suite does not use (EC)DHE, the version is SSLv3 to TLS 1.2, and the session is not resumed; it cannot decrypt TLS 1.3 this way. in context
• A passive capture of SIP over TLS negotiated with ECDHE or TLS 1.3 cannot be decoded with the server's RSA key alone; it needs a TLS key log from an endpoint or a trace taken inside the SBC after decryption. inferred in context
• Wireshark can decrypt TLS using a key log file (preference tls.keylog_file), and this method works even when a Diffie-Hellman key exchange is used. in context
• Wireshark's RSA private key decryption cannot be used with (EC)DHE cipher suites or with TLS 1.3, and needs the server certificate's private key and a full handshake containing ClientKeyExchange (no resumed sessions). in context

Cite this source record

APA

WarmTransfer. (2026, September 23). TLS - Wireshark Wiki. WarmTransfer. https://warmtransfer.net/knowledge/sources/wireshark-wiki-tls

BibTeX

@misc{warmtransfer-wireshark-wiki-tls,
  title  = {TLS - Wireshark Wiki},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/wireshark-wiki-tls},
  note   = {Wireshark Foundation, accessed 2026-09-23}
}