如何在 Firefox 下获取当前 SSL 连接使用的密钥？
我想问一个简单的问题。是否有任何适用于 Firefox 的插件或工具如何在 SSL 握手期间从主密钥生成会话密钥，通过该密钥对整个客户端/服务器通信进行对称编码？我需要它是因为通过 Wireshark 或 PCAP 库对通信（POST/GET/等）进行解码。正如我所看到的，Firebug 正在显示解密的通信，因此我希望存在一些正确的方法来获取此会话密钥:)
谢谢大家的帮助。
I would like have one quick question. Is there any addon for Firefox or tool how to get session key generated from master secret during SSL handshake by which is encoded symmetrically whole client/server communication? I need it due to decoding of communication (POST/GET/etc..) via Wireshark or PCAP library. As I can see Firebug is showing decrypted communication so I hope there exist some proper ways how to reach this session key :)
Thank you all for a help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我有好消息告诉你。实际上，您可以从 Firefox 和 Chrome 获取所需的主密钥数据。您可以使用 Wireshark 中的输出文件来解密 SSL/TLS 流量，而无需 SSL/TLS 服务器的私钥。在这里查看“方法 2”： http:// www.root9.net/2012/11/ssl-decryption-with-wireshark-private.html
作为提示，如果您不想重新启动计算机，只需打开命令提示符并运行：
set SSLKEYLOGFILE=c:\sslKeyLogFile.txt
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
由于 Firefox 是从您添加环境变量的同一会话启动的，因此它将随之启动变量集。否则，在系统设置对话框中设置后需要重新启动 Windows。
我还想指出 Chris 的答案不一定是错误的，这是一个相当新的功能。直到 Wireshark 1.6 才发布。
I have good news for you. You can actually get the Master-Key data that you need from both Firefox and Chrome. And you can use the output file in Wireshark to decrypt the SSL/TLS traffic without the need for the private key from the SSL/TLS server. Check out "Method 2" here: http://www.root9.net/2012/11/ssl-decryption-with-wireshark-private.html
As a tip, if you don't want to reboot your machine just open a command prompt and run:
set SSLKEYLOGFILE=c:\sslKeyLogFile.txt
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
Since Firefox is being launched from the same session that you added the environment variable in, it will launch with that variable set. Otherwise a restart of Windows will be required after setting it in the System settings dialogs.
I also want to point out that the answer from Chris wasn't necessarily wrong, this is a fairly new feature. It didn't make it into release until Wireshark 1.6.
如果您想使用 Wireshark，那么预主密钥对您来说没有用（您在问题中将其称为“密码密钥”）。
仅当您指定服务器的 RSA 私钥时，Wireshark 才能解密流量，与预主密钥不同，该私钥不会在每个连接上更改。但是，由于显而易见的原因，您无法通过浏览器或其他任何方式获得该信息。
如果您想解密 SSL 流量，我建议使用中间代理，例如 Fiddler。它不会被动地捕获流量，而是代理流量，这使其能够实际解密发送和接收的数据。
If you want to use Wireshark then the pre master secret will be of no use for you (you refer to it as 'cipher key' in your question).
Wireshark can only decrypt traffic if you specify the RSA private key of the server, which doesn't change on every connection unlike the pre master secret. However, you can't get that through your browser or anything else for obvious reasons.
If you want to decrypt SSL traffic I suggest using an intermediate proxy instead, like Fiddler. It does not passively capture traffic but proxies the traffic, which enables it to actually decrypt the data sent and received.