This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Where to find the private key?

I've enabled "Scan HTTPS (SSL) Traffic", but I can't find the private key which is used for the certificates. Those I've found under [FONT="Courier New"]/var/chroot-http/var/certcache/[/FONT], but where is the private key?

This thread was automatically locked due to age.

0 gilipeled over 10 years ago

Hi ,

When you enable scan SSL you need to install the UTM certificate on all computers.

All my best.
Gilipeled

Gil Peled.

CEO- Expert2IT LTD.

SOPHOS Platinum Partner.

Gil@expert2it.co.Il.
Cancel
Vote Up 0 Vote Down

Cancel
0 usrAsd32 over 10 years ago in reply to gilipeled

I have to inspect some captured traffic. And for the decryption, I need the private key.
Cancel
Vote Up 0 Vote Down

Cancel
0 teched_01 over 10 years ago
Does this contain the private key(s) you are looking for?
cc get_objects_filtered '$_->{type} eq "signing_ca"'

(Run from command line, requires root, mind the support/warranty warnings)

Addendum, September 3, 2015:
Sophos removed the get_objects_filtered function from cc/confd-client.plx.
See https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/47038 for more on CA related cc commands.
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Dunn over 10 years ago

usrAsd32, if you need to watch HTTP/S traffic only, rather than WireShark you can try Fiddler. It installs itself as a local proxy. All web traffic to/from your computer flows through it, and it can do HTTPS inspection.

Fiddler - The Free Web Debugging Proxy by Telerik
Cancel
Vote Up 0 Vote Down

Cancel
0 usrAsd32 over 10 years ago in reply to teched_01
Does this contain the private key(s) you are looking for?
cc get_objects_filtered '$_->{type} eq "signing_ca"'

(Run from command line, requires root, mind the support/warranty warnings)

That helped me a lot. Thank you!
Cancel
Vote Up 0 Vote Down

Cancel
0 usrAsd32 over 10 years ago in reply to Michael Dunn

usrAsd32, if you need to watch HTTP/S traffic only, rather than WireShark you can try Fiddler. It installs itself as a local proxy. All web traffic to/from your computer flows through it, and it can do HTTPS inspection.

Fiddler - The Free Web Debugging Proxy by Telerik

Ui, didn't know fiddler yet. Looks nice, thanks for the hint!
Cancel
Vote Up 0 Vote Down

Cancel
0 gilipeled over 10 years ago

Hi ,

Can you explain why do you need to inspect HTTPS traffic ?
What you want to achieve ?
Maybe it will help us to help you :-)

All my best,
Gilipeled.

Gil Peled.

CEO- Expert2IT LTD.

SOPHOS Platinum Partner.

Gil@expert2it.co.Il.
Cancel
Vote Up 0 Vote Down

Cancel
0 rstgermain over 9 years ago in reply to gilipeled

I realize this is an old post but were you able to use the private key and decrypt the packets using Wireshark?

I am thinking the user that initially posted wanted to take network dumps and decrypt the traffic using the private key that the appliance was using for HTTP inspection.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 9 years ago

I'm not sure, but iirc you can install your own keys in the UTM.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 usrAsd32 over 9 years ago

As far as I remember I was able to decrypt the traffic.

But unfortunately I failed to achieve my goal: I wanted to tap the firmware downloaded by my Panasonic Smart-TV for further analyzation, but the updater only accepts certificates signed by Panasonic.
Cancel
Vote Up 0 Vote Down

Cancel