I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file
cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into Wireshark as an RSA cert but it requested a passphrase to decrypt the key. Of course I don't have the passphrase but surely the application must know it somehow and I couldn't find the passphrase in any configuration files so I figure it must be in the main executable or possibly in a dll.
The program uses
libssl-1_1.dll, my plan is to disassemble the main executable and try to find a function call to the OpenSSL API (
libssl-1_1.dll) and see if the passphrase is possibly referenced somewhere in it.
If I were looking for a particular function that takes a passphrase to decrypt a PEM file what function would it be? And if anyone has any better ideas please let me know. I've never been this directly involved with SSL/TLS in applications, any time I've written a server/client application that used TLS it's been in Python using very high level methods. Thanks for any help.