如何调试 ssl 连接？
我有一个通过 https 连接到 Web 服务的客户端应用程序。我需要“嗅探”Web 服务和客户端之间的所有网络流量，以检查一切是否正常，即我必须调试连接。
我尝试过 Wireshark，但由于我没有服务器私钥，wireshark 屏幕上显示的数据当然是加密的。
当我无法访问服务器本身并因此无法访问私钥和其他相关内容时，有没有办法观察客户端和 Web 服务之间的 ssl 网络流量？
提前致谢。
I have a client application that connects to a web service over https. I need to "sniff" all the network traffic between web service and my client to check if everything is okay, i.e, i have to debug the connection.
I have tried Wireshark but since I do not have server private key, data shown on wireshark screen is, of course, encrypted.
Is there a way to observe ssl network traffic between my client and web service when I do not have access to server itself and therefore private keys and other related stuff?
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
请参阅：调试 SSL 通信。
我知道理论上这是可以做到的 - 您可以设置一个与目标 Web 服务通信的代理，让您的应用程序通过该代理进行连接。这是一个已知的限制 - Https 假定您信任计算机上安装的所有代理和证书。它是一种中间人攻击的形式。
看看 Fiddler 是否有用。
See this: Debugging SSL communications.
I know theoretically it can be done - you can setup a proxy that communicates with the target web-service, point your application to connect via this proxy. Its a known limitation - Https assumes you trust all proxy and certificates installed on your machine. Its a form of Man-in-the-middle attack.
See if Fiddler would be of some use.
你安装了python吗？
pip install mitmproxy
mitmproxy -p 1234
甚至一个 video 给你
（顺便说一句，我必须在 debian 上 apt-get install python-lxml apt-get 更新后挤压）
do you have python installed?
pip install mitmproxy
mitmproxy -p 1234
even a video for you
(by the way, i had to apt-get install python-lxml on debian squeeze after an apt-get update)
Burp Suite（甚至免费版）允许您设置 SSL“代理”，它将呈现一个与您的应用程序不同的证书，它将为您解密（并显示）流量。如果你也想在 localhost 中测试服务器，它也允许你设置代理（我在 Windows 中使用 Wireshark 和 Fiddler 无法做到这一点）。
Burp Suite (even Free Edition) allows you to set a SSL "proxy", it will present a different certificate to your application and it will decrypt (and display) the traffic for you. And if you want to test with the server in localhost too it allow you to set the proxy too (something I have been unable to do with Wireshark in Windows, and Fiddler).
如果您无权访问服务器的私钥，则无法执行太多操作来查看受 SSL/TLS 保护的内容。 （至少您会看到初始握手。）
如果您对客户端拥有完全控制权，您可以编写一个假服务器，该服务器将具有您控制的私钥和证书，并且将中继客户端发送的所有内容到实际的服务器。为此，您需要让客户端信任您自己的证书，因此您需要控制客户端。调整客户端上相应的
hosts文件来执行 DNS 欺骗可能会更容易，从而使到正确主机名的连接转至您的假服务器。If you don't have access to the server's private key, there isn't much you can do to see what's being protected by SSL/TLS. (You'll get to see the initial handshake at least.)
If you have entire control on the client, you could write a fake server that would have a private key and certificate that you control, and that would relay everything sent by the client to the actual server. For this, you'd need to make the client trust your own certificate, hence you need control of the client. It might be easier to tweak the corresponding
hostsfile on the client to perform the DNS spoofing too, to make connections to the right host name go to your fake server instead.