0

My goal is capture the pcap file on my linux machine which is using nginx to connect and decrypt those packets using ssl key log file.but i am unable to find how to capture ssl key log file on nginx. Could someone please help me how to capture ssl key log file ?

   log_format quic '$remote_addr - $remote_user [$time_local] '
                   '"$request" $status $body_bytes_sent '
                   '"$http_referer" "$http_user_agent" "$http3"';

   access_log /var/log/nginx/access.log quic;

   server {
        # for better compatibility it's recommended
        # to use the same port for quic and https
        listen 8443 http3 reuseport;
        listen 8443 ssl;

        ssl_certificate     /etc/ssl/certs/ssl-cert-snakeoil.pem;
        ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
        ssl_protocols       TLSv1.3;

        location / {
            # required for browsers to direct them into quic port
            add_header Alt-Svc 'h3=":8443"; ma=86400';
        }

127.0.0.1 - - [23/Dec/2022:13:13:25 +0000] TLSv1.3/TLS_AES_128_GCM_SHA256 "GET / HTTP/3.0" 200 751 "-" "curl/7.87.1-DEV" "h3"

How do I configure nginx to log ssl key log information?

  • 1
    I’m voting to close this question because the OP fails to do basic research first. A simple search for [nginx ssl key log file](https://www.google.com/search?q=nginx+ssl+key+log+file) provides [this question at security.stackexchange.com](https://security.stackexchange.com/questions/216065/extracting-openssl-pre-master-secret-from-nginx) as the first hit and [this nginx module](https://github.com/tiandrey/nginx-sslkeylog) as the second - both seem to solve the problem. – Steffen Ullrich Dec 23 '22 at 14:12
  • tried below and nothing worked https://security.stackexchange.com/questions/216065/extracting-openssl-pre-master-secret-from-nginx https://serverfault.com/questions/620123/how-can-i-let-nginx-log-the-used-ssl-tls-protocol-and-ciphersuite – kartheek dasari Dec 23 '22 at 14:42
  • If specific things don't work it is advised to show in your question (not in a comment) what exactly you tried and where exactly you've failed – Steffen Ullrich Dec 23 '22 at 15:23
  • https://trac.nginx.org/nginx/ticket/2498 – kartheek dasari May 25 '23 at 16:15

0 Answers0