When the communication between server and client starts -after a request, the computers agree on an encryption protocol to protect the data, the TLS handshake. The data may not be encrypted on the server, but it should be before sending using the server's private key.

If protocols involves asymmetric encryption (and exchange of public key) files (or the HTTP-body) are encrypted, the browser needs the locally generated private key to decrypt it.

This may be more complicated and I'm open to corrections. But just by checking many of the x509 certificates (by clicking on firefox lock symbol) it seems many certificates involve asymmetric cryptography (maybe this is used to exchange the symmetric keys, and next move on to use symmetric encryption).

Assuming all this:

Is it possible to get decrypt the data sent by the server using our private key and the information on the certificate (by clicking on the lock at the URL bar) to decrypt the file via command line using openssl?

(I am not sure where the private key that I use locally to decrypt the file is stored by mozilla firefox.)

I know it should be possible to get the encrypted packets on wireshark, but am not sure about the particular details to decrypt.

  • $\begingroup$ Welcome to Cryptography.SE. I feel that this is a rather [superuser.se] question. Since it is about the usage of OpenSSL and browsers. $\endgroup$
    – kelalaka
    May 25 '21 at 19:09
  • 1
    $\begingroup$ Flagged for the mods. wait for some time? $\endgroup$
    – kelalaka
    May 25 '21 at 19:25
  • 3
    $\begingroup$ The browser (or in general HTTPS client) only generates a privatekey for [EC]DHE-type keyexchanges, and doesn't store it anyplace, and it couldn't ever decrypt anything. All encryption/decryption and MAC-ing in SSL/TLS use a series of up to 6 symmetric keys which are derived from shared secrets -- for older protocols (through 1.2) the premaster and master secrets, and for 1.3 a series of (usually) two inputs and three 'secrets'. Firefox, and Chrome, will write these session secrets to a file if configured with SSLKEYLOGFILE -- there are already numerous Qs about this. ... $\endgroup$ May 26 '21 at 5:57
  • 3
    $\begingroup$ ... However, the data from a webserver is not encrypted as a single unit, or stored as a file that could be decrypted, although invididual entities, or bodies, may be cached (already decrypted), possibly in files. If you did have all the data for a single response in a series of files, and the derived keys, you could decrypt with OpenSSL command line if the protocol is below 1.2, or equal 1.2 but using an older ciphersuite. If it used an AEAD ciphersuite in 1.2, which is now common, or used 1.3 which always uses AEAD, OpenSSL commandline does not support that. $\endgroup$ May 26 '21 at 5:57
  • 1
    $\begingroup$ The key exchange uses asymmetric crypto, yes, though for shared secrets as I described not actual symmetric keys. But there is never a browser/client key that asymmetrically decrypts anything. The old/obsolete plain-RSA key exchange encrypts the premaster secret with the server publickey and decrypts it on the server with the server privatekey. The more common Diffie-Hellman-based key exchanges use keypairs on both ends but only for secret agreement not encryption or decryption. No matter what you think there is NEVER asymmetric decryption on the client. $\endgroup$ May 28 '21 at 15:56

Browse other questions tagged or ask your own question.