Verify the alias of the private key assigned to that port.Open the properties for the desired listen port.

Execution Exporting the necessary private key Private keys that were created elsewhere and stored within an HSM-secured keystore can still be used but cannot be exported from the Gateway and will have to be exported from another system.

Using a hardware security module prevents a packet capture from being decrypted as private keys present in the HSM cannot be exported. This limitation prevents even a valid administrator from decrypting a packet capture after the transaction is complete. Perfect forward secrecy prevents an attacker from taking a packet capture and decrypting the capture later after a set of keys are compromised. Diffie-Hellman key exchange allows for perfect forward secrecy. This article will focus on using the Gateway as a server.Ī packet capture cannot be decrypted if an SSL/TLS channel is opened with cipher suites using Diffie-Hellman key exchange (which includes elliptic curve ciphers). If the Gateway is a client for a TCP connection then it would be necessary to procure the key from the server or service administrator. If the Gateway is the server for a TCP connection then the Gateway's private key can be exported and used. A hardware security module is not in use with the Gateway appliance.ĭecrypting SSL/TLS-encrypted traffic requires access to the private key used by the server.The Gateway is not using a cipher suite based upon Diffie-Hellman key exchange.The Gateway is acting as the server in a TCP connection.

This article has the following limitations: Background Wireshark can be used to decode and decrypt SSL-TLS-encrypted communications between a client application and the CA API Gateway appliance.

Wireshark decrypt tls application data