This limitation prevents even a valid administrator from decrypting a packet capture after the transaction is complete. Perfect forward secrecy prevents an attacker from taking a packet capture and decrypting the capture later after a set of keys are compromised.

Diffie-Hellman key exchange allows for perfect forward secrecy. This article will focus on using the Gateway as a server.Ī packet capture cannot be decrypted if an SSL/TLS channel is opened with cipher suites using Diffie-Hellman key exchange (which includes elliptic curve ciphers). If the Gateway is a client for a TCP connection then it would be necessary to procure the key from the server or service administrator. If the Gateway is the server for a TCP connection then the Gateway's private key can be exported and used. A hardware security module is not in use with the Gateway appliance.ĭecrypting SSL/TLS-encrypted traffic requires access to the private key used by the server.The Gateway is not using a cipher suite based upon Diffie-Hellman key exchange.The Gateway is acting as the server in a TCP connection.This article has the following limitations: Background Wireshark can be used to decode and decrypt SSL-TLS-encrypted communications between a client application and the CA API Gateway appliance.

Decrypt wireshark packet capture