Key File : We chose the file that we previously converted to. IP Address : IP of the server where the certificate is installed Open the Protocol option, select SSL and click on Edit. Now we have to configure our Wireshark to use the private key file, for this we open the Wireshark and go to Edit - Preferences (Shift + Ctrl + P). UfZSuWUFoiu1XPS6vWPtQ8VRjb0a4hGXSMYDxyupDgEAgRDIMN0jyW1PklbsOZObĪJWQWC5UQuoWEP4gw + 3aC87UTGrk8U10X0DpQdfyD3Bjwwvai3mEYw = MIIEpAIBAAKCAQEAiFBWj / E7y6MAMUWacV2aeSpt / j2wHzB7xIYBCMnJy0u869eb Now you should have a file with the name sipout.pem (each one that puts the name that you want) similar to this one ( without the dots, this I have put it ) Once installed we must execute the following commands:ġ- openssl pkcs12 -nodes -in SIP.pfx -out sip.pem -nocerts -nodesĢ- openssl rsa -in sip.pem -out sipout.pem Let's convert the PFX to PEM, which is the format that Wireshark can use and we will use OpenSSL. Once we have our certificate exported with its corresponding private key This article only describes a procedure that you must follow to analyze the SSL or TLS traffic used by Lync (or any other service) to encrypt communications. Hence the previous comment that we are not hacking anything at all, since the certificate with its private key is exported by us.

If we do not have the private key we can not do anything, for that we must have access to it. For this we need to have the certificate that uses the server to which we want to connect with its private key, so that we have to export it from the server with it. With Wireshark (and other tools) we can decrypt SSL traffic (decrypting is not equal to 'juankear' or similar) to be able to analyze it. But of course, if we want to analyze which is the possible problem that we have would be impossible.

you will see that the traffic is encrypted and it would be impossible to review anything, so far everything is correct.

The problem is given when you want to see why the Lync client does not connect, or what kind of DSCP uses our Lync client when we start a conference, etc.

the traffic between servers is protected via MTLS and from client to server via TLS

Surely on occasion you have used Wireshark (network traffic analyzer: sniffer).

How to decrypt wireshark captures