Packet analysis lab 9 of 12
TLS: handshakes and certificates with key-log decryption
Read encrypted traffic without breaking it. You compare TLS 1.3 and TLS 1.2 handshakes, read the server name, versions, cipher suites and certificates, decrypt your own sessions with a key log file set in Wireshark's protocol preferences, export the decrypted page, and diagnose a connection that fails on an untrusted certificate.
Run this lab
It needs Lite: its 2 nodes are set to 2 vCPU and 2,048 MB in total. That fits the free demo too.
In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 09 - TLS - handshakes and certificates with key-log decryption
- Level
- Advanced
- Time
- About 70 minutes
- Nodes need
- 2 vCPU, 2,048 MB
- Smallest plan
- Lite
The scenario
Fellside Outdoor's trade portal, portal.fellside.lab on SRV, takes orders from shops over HTTPS. The security team asks two questions: what can someone who captures this traffic actually see, and why does the old supplier portal on port 9443 refuse every connection? You'll answer both from captures, and then decrypt your own sessions, which is how analysts troubleshoot encrypted applications without breaking the encryption.
| Device | Interface | Address | Role |
|---|---|---|---|
| WS | eth0 | 10.100.0.10/24 | your workstation and the client (curl, Firefox) |
| SRV | eth0 | 10.100.0.20/24 | portal: 443 (TLS 1.3), 8443 (TLS 1.2 only), 9443 (old supplier portal), HTTP 80 (intranet with the company root CA) |
WS's /etc/hosts already maps portal.fellside.lab and legacy.fellside.lab to SRV. The portal's certificate was issued by the company's own CA, Fellside Lab Root CA.
Your workstation, WS. Open WS's console (a remote desktop, root / eve), start Wireshark from Applications > Internet > Wireshark, and open a terminal. Write answers in /root/answers.txt (pluma /root/answers.txt &).
What you’ll practise
- Read a TLS ClientHello and ServerHello: SNI, versions, cipher suites and extensions
- Explain what TLS 1.3 encrypts that TLS 1.2 leaves visible, including the certificate
- Read a certificate's subject, issuer and validity in a capture
- Decrypt TLS with a key log file through Wireshark's TLS protocol preference, and export objects from the decrypted HTTP
- Diagnose a handshake failure from its alert
The tasks
- Capture three HTTPS sessions
- Read the handshake
- Certificates
- Decrypt with a key log
- Why the old portal fails
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- WS
eth0to SRVeth0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| WS | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
| SRV | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
Packet analysis with Wireshark and tcpdump guided labs.Open
09 - TLS - handshakes and certificates with key-log decryptionand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More Packet analysis labs
Related labs in other courses
CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.