The Wireshark screenshot above shows DNS-over-HTTPS (DoH) traffic in the file proxy-191023-091924.pcap, which was captured live during my TLS Interception and Decryption talk at the CS3Sthlm conference in 2019. Figure 1 - DNS-over-HTTPS (DoH) traffic in the file proxy-191023-091924.pcap. PolarProxy creates a unique root CA certificate for each installation, which must be trusted by clients that will have their TLS traffic decrypted. PolarProxy’s root CA must, therefore, be trusted by the operating systems, browsers, and applications that you wish to decrypt TLS traffic from. The fact that PolarProxy exports the decrypted traffic in a decrypted format without any TLS headers also enables users to inspect the decrypted traffic with products that don’t support TLS decryption, such as intrusion detection and network forensics products like Suricata, Zeek, and NetworkMiner. Other popular use cases for PolarProxy are to inspect encrypted traffic from IoT devices and other embedded products or to analyse otherwise encrypted traffic from mobile phones and tablets.

PolarProxy is primarily designed for inspecting otherwise encrypted traffic from malware, such as botnets that use HTTPS for command-and-control of victim PCs. Because of this, PolarProxy can be used as a generic TLS decryption proxy for just about any protocol that uses TLS encryption, including HTTPS, HTTP/2, DoH, DoT, FTPS, SMTPS, IMAPS, POP3S and SIP-TLS. PolarProxy doesn’t interfere with the tunnelled data in any way, it simply takes the incoming TLS stream, decrypts it, re-encrypts it and forwards it to the destination.

I added the ssl configuration to the /etc/nginx/sites-enabled/default file the certificate.PolarProxy is a transparent TLS proxy that outputs decrypted TLS traffic as PCAP files. I created a self-signed certificate with the next command: sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out localhost.crt What I did was to add an Nginx as a reverse proxy. (For testing I am using Postman to create a request to a secure server.)

I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet.

Youtube wireshark decrypt ssl