Back to Network Exploitation & Wireshark
Network Exploitation & Wireshark

How to inspect decrypted HTTPS traffic in Wireshark using SSLKEYLOGFILE environment variables?

Set SSLKEYLOGFILE, launch the client, point Wireshark TLS prefs to the file, and traffic decrypts.

R
Rajesh Sharma 👑 Tier 3 Elite
Aug 9, 2026 · 1 min read

Set SSLKEYLOGFILE to a writable file, start the TLS client so it writes session secrets, then configure Wireshark to load that file and decrypt the traffic.

Steps

1. Choose a path, e.g. C:/temp/keys.log or /tmp/keys.log.
2. Export the variable:
```bash
# Windows cmd
set SSLKEYLOGFILE=C:/temp/keys.log
# Linux/macOS bash
export SSLKEYLOGFILE=/tmp/keys.log
```
3. Launch the browser or application after the variable is set. Chrome, Edge, and Firefox (≥ 58) automatically append pre‑master and TLS‑1.3 secrets.
4. In Wireshark open Edit → Preferences → Protocols → TLS.
5. Set (Pre)-Master‑Secret log filename to the same path and press OK.
6. Capture or open a pcap; apply the filter tls – decrypted HTTP fields appear in the packet details.
7. For TLS 1.3 ensure “TLS 1.3 secrets” is enabled (Wireshark 4.2+ reads them from the same log).

Gotcha
The client must be started after SSLKEYLOGFILE is defined; existing processes won’t rewrite the file, and Wireshark cannot decrypt sessions whose keys were logged before the capture began.

Read the evidence

Sources used in this thread

Open the original material, compare the claims, and form your own view.

Community notes

Add context, not noise (0)

Corrections, lived experience, useful examples, and better sources belong here.

Nothing added yet. Be the first to make this thread more useful.
Click here to write a reply...
🔒

Authentication Required

Join Trendzza to begin your journey. Submit tasks, complete batches, help peers, and earn your way to Tier 3.