5 ms·
Alternative title: "Sanity Coming to TLS"
by okket 10y ago
Alternative title: "Sanity Coming to TLS"
- Animats 10y agoYes. It's mostly about taking stuff out. Did OpenSSL take out the "debug feature" which bypasses encryption and logs keys if you set an environment variable?
- Kikawala 10y agoI don't know of an environment variable to enable that with OpenSSL, but there is one for NSS. For recent versions it has to be enabled at compile time, but it's enabled for the official Firefox binaries. https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NS...
- walterbell 10y agoDo you have a pointer to that variable, code or doc? A web search didn't return anything obvious.
- dvorak42 10y agoSSLKEYLOGFILE is the one that a few implementations use.
- duskwuff 10y ago1. That feature is a feature of the OpenSSL implementation, not a feature of TLS itself. 2. It's also incredibly useful for debugging SSL implementations. (Much more so than as some sort of backdoor, since that's what you seem to be implying.)
- chillydawg 10y agoWithout that, you can't intercept https traffic and analyse it properly with tools like charles or wireshark. They both rely on reading the keyfile openssl et al write out when triggered to do so.