Set SSLKEYLOGFILE to a writable file, start the TLS client so it writes session secrets, then configure Wireshark to load that file and decrypt the traffic.
Steps
1. Choose a path, e.g. C:/temp/keys.log or /tmp/keys.log.
2. Export the variable:
```bash
# Windows cmd
set SSLKEYLOGFILE=C:/temp/keys.log
# Linux/macOS bash
export SSLKEYLOGFILE=/tmp/keys.log
```
3. Launch the browser or application after the variable is set. Chrome, Edge, and Firefox (≥ 58) automatically append pre‑master and TLS‑1.3 secrets.
4. In Wireshark open Edit → Preferences → Protocols → TLS.
5. Set (Pre)-Master‑Secret log filename to the same path and press OK.
6. Capture or open a pcap; apply the filter tls – decrypted HTTP fields appear in the packet details.
7. For TLS 1.3 ensure “TLS 1.3 secrets” is enabled (Wireshark 4.2+ reads them from the same log).
Gotcha
The client must be started after SSLKEYLOGFILE is defined; existing processes won’t rewrite the file, and Wireshark cannot decrypt sessions whose keys were logged before the capture began.