"TLS-N", "TLS Sign", and maybe a couple others were supposed to add non-repudiation. But they didn't really go anywhere: https://security.stackexchange.com/qu

"TLS-N", "TLS Sign", and maybe a couple others were supposed to add non-repudiation. But they didn't really go anywhere: https://security.stackexchange.com/questions/52135/tls-with-non-repudiation-what-happened-with-tls-sign https://security.stackexchange.com/questions/52135/tls-with-... https://security.stackexchange.com/questions/103645/does-ssl-tls-provide-non-repudiation-service/ https://security.stackexchange.com/questions/103645/does-ssl... There are some special cases, like I think certain headers for signing e-mails, that do provide non-repudiation. For that, `tcpdump` with `SSLKEYLOGFILE` will probably get you started on capturing what you need.