The server never shares its private key with anyone.Īt the end of the server key exchange, the server sends a server hello done message. The client and the server use the public key to encrypt messages, which can only be decrypted with the server’s private key. The public key is actually included in the certificate.

The second thing the server sends is its public key and signature. I will tell you how to find these root CAs in your web browser at the end of this article. If the server’s certificate is issued by a trusted root CA or immediate CA, then the browser trust the server’s certificate.

Intermediate CA is a CA that is trusted by root CA. The server’s certificate is issued by root CA or intermediate CA. These root CAs are third parties that are trusted by web browsers. Web browsers store a list of Root CA(Certificate Authority) in themselves. The client (web browser) validates the server’s certificate. The first is its SSL/TLS certificate to the client. Then the server sends a message to the client containing the SSL/TLS version and cipher suite it chose.Īfter the server and client agree on the SSL/TLS version and cipher suite, the server sends two things. The server will see the list of SSL/TLS versions and cipher suites and pick the newest the server is able to use. The client lists the versions of SSL/TLS and cipher suites it’s able to use. Log out and log back in for the changes to take effect. Once it’s installed, run the following command to add your user account to the wireshark group so that you can capture packets. If you are asked “Should non-superusers be able to capture packets?”, answer Yes.

RHEL/CentOS/Fedora: sudo dnf install wireshark.

Debian/Ubuntu: sudo apt install wireshark.

Linux users can install Wireshark from the default repository. Windows and macOS users can download Wireshark from the official website. You can use Wireshark to capture HTTPS connections. In this article, I will explain the SSL/TLS handshake with Wireshark.

A TLS encrypted connection is established between the web browser (client) with the server through a series of handshakes.

Wireshark linux terminal