I have a client VM and server VM communicating using SSL. The client VM runs wireshark capture using CLI
Wireshark GUI is running locally on a different machine.
As USER on the client VM I initiated a RESTful HTTP session over SSL using python scripts.
I have captured the conversation using wireshark and now want to de-encrypt the application data.
I copied the captured file local machine and now want to analyse the application data.
I have ssh access only to the client VM and following the steps on https://wiki.wireshark.org/SSL leads me to believe that I should
1) Copy the contents of /home/USER./ssh/id_rsa on the client VM to the local machine.
2) Point to the file in the SSL preferences RSA keyfiles list. 3) In same SSL preferences configure IP address, port
I then expected to be able to view the encrpted data but I still see
My theory is that I am using the incorrect RSA_PRIVATE_KEY , so I want to confirm which key is used in the SSL session.
If the RSA PRIVATE KEY is correct what else should I check?