I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into Wireshark as an RSA cert but it requested a passphrase to decrypt the key. Of course I don't have the passphrase but surely the application must know it somehow and I couldn't find the passphrase in any configuration files so I figure it must be in the main executable or possibly in a dll.

The program uses libcurl.dll and libssl-1_1.dll, my plan is to disassemble the main executable and try to find a function call to the OpenSSL API (libssl-1_1.dll) and see if the passphrase is possibly referenced somewhere in it.

If I were looking for a particular function that takes a passphrase to decrypt a PEM file what function would it be? And if anyone has any better ideas please let me know. I've never been this directly involved with SSL/TLS in applications, any time I've written a server/client application that used TLS it's been in Python using very high level methods. Thanks for any help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.