If you get a mitmproxy working, you probably won't need the Wireshark bits. Getting ephemeral keys out can be tricky and might not even be worth the trouble. S

If you get a mitmproxy working, you probably won't need the Wireshark bits. Getting ephemeral keys out can be tricky and might not even be worth the trouble. Sometimes I find it convenient to redirect traffic with iptables. That way, if I can classify which traffic interests me, only that traffic will pass through the proxy for inspection. A warning though, SSL specific problems tend to go away when being looked at that way :). A third method I know people use is LD_PRELOADing a hook in the application to dump keys (search for sslkeylog.c for an example) but that's far too exciting for me to try in production. Between these three methods I tend to reach for the proxy first.