[GH-ISSUE #1671] Support TLS key logging #1664

Closed
opened 2026-03-03 19:53:18 +03:00 by kerem · 13 comments
Owner

Originally created by @seidnerj on GitHub (Jun 7, 2023).
Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1671

Originally assigned to: @NghiaTranUIT on GitHub.

Description

Support TLS key logging, this can be implemented by Proxyman looking for a "SSLKEYLOGFILE" environment variable as is done in other applications or by some other means (UI-wise).

Why this feature/change is important?

I am trying to debug issues that seem to origin in the communicate between Proxyman and the target server, I am using Wireshark to look at the relevant traffic but unfortunately (in this case) it is encrypted (TLS), if the keys could be logged as in other applications, I could then load them to Wireshark and take a look at the unencrypted traffic. Without this, I have no insight into what is happening between Proxyman and the target server.

Originally created by @seidnerj on GitHub (Jun 7, 2023). Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1671 Originally assigned to: @NghiaTranUIT on GitHub. ## Description Support TLS key logging, this can be implemented by Proxyman looking for a "SSLKEYLOGFILE" environment variable as is done in other applications or by some other means (UI-wise). ## Why this feature/change is important? I am trying to debug issues that seem to origin in the communicate between Proxyman and the target server, I am using Wireshark to look at the relevant traffic but unfortunately (in this case) it is encrypted (TLS), if the keys could be logged as in other applications, I could then load them to Wireshark and take a look at the unencrypted traffic. Without this, I have no insight into what is happening between Proxyman and the target server.
kerem 2026-03-03 19:53:18 +03:00
Author
Owner

@NghiaTranUIT commented on GitHub (Jun 8, 2023):

Thanks for opening the ticket. I might consider to implement this feature if we collect more requests 👍

<!-- gh-comment-id:1582692926 --> @NghiaTranUIT commented on GitHub (Jun 8, 2023): Thanks for opening the ticket. I might consider to implement this feature if we collect more requests 👍
Author
Owner

@swznd commented on GitHub (Sep 20, 2023):

agreed, I have similar issue, I need to compare request between app to proxyman and proxyman to target server

<!-- gh-comment-id:1727608930 --> @swznd commented on GitHub (Sep 20, 2023): agreed, I have similar issue, I need to compare request between app to proxyman and proxyman to target server
Author
Owner

@dabing1022 commented on GitHub (Jun 1, 2024):

June 1, 2024. Excuse me, is it supported now?

<!-- gh-comment-id:2143272780 --> @dabing1022 commented on GitHub (Jun 1, 2024): June 1, 2024. Excuse me, is it supported now?
Author
Owner

@novitae commented on GitHub (Jan 8, 2025):

Any news ? @NghiaTranUIT

<!-- gh-comment-id:2577385325 --> @novitae commented on GitHub (Jan 8, 2025): Any news ? @NghiaTranUIT
Author
Owner

@NghiaTranUIT commented on GitHub (Jan 8, 2025):

@novitae To be honest, I don't know how to implement it. Can you show me the current solution from another app?

<!-- gh-comment-id:2577409089 --> @NghiaTranUIT commented on GitHub (Jan 8, 2025): @novitae To be honest, I don't know how to implement it. Can you show me the current solution from another app?
Author
Owner

@novitae commented on GitHub (Jan 8, 2025):

@novitae To be honest, I don't know how to implement it. Can you show me the current solution from another app?

I just took a look at how mitmproxy does it, but their backend is python, so it will be different for you.

What crypto backend are you using ? OpenSSL ? If it is, or any other big one, I'm pretty sure it's easy and there are already methods to make it easier. I am willing to do the researches !

<!-- gh-comment-id:2577544399 --> @novitae commented on GitHub (Jan 8, 2025): > @novitae To be honest, I don't know how to implement it. Can you show me the current solution from another app? I just took a look at [how mitmproxy does it](https://github.com/mitmproxy/mitmproxy/blob/70e59c2d4157f017f09163bc6b33bcd2a8f83594/mitmproxy/net/tls.py#L119C1-L164C1), but their backend is python, so it will be different for you. What crypto backend are you using ? OpenSSL ? If it is, or any other big one, I'm pretty sure it's easy and there are already methods to make it easier. I am willing to do the researches !
Author
Owner

@NghiaTranUIT commented on GitHub (Jan 8, 2025):

@novitae It's what you're looking for?

Screenshot 2025-01-08 at 7 43 42 PM

  • mitmproxy does TLSKeyLogging for both way: client -> mitmproxy, and mitmproxy -> servers. Do you need both?
<!-- gh-comment-id:2577593248 --> @NghiaTranUIT commented on GitHub (Jan 8, 2025): @novitae It's what you're looking for? ![Screenshot 2025-01-08 at 7 43 42 PM](https://github.com/user-attachments/assets/46bf6fce-95fa-496c-860c-a719054f4c19) - mitmproxy does TLSKeyLogging for both way: client -> mitmproxy, and mitmproxy -> servers. Do you need both?
Author
Owner

@novitae commented on GitHub (Jan 8, 2025):

  • mitmproxy does TLSKeyLogging for both way: client -> mitmproxy, and mitmproxy -> servers. Do you need both?

Yes usually you have to log both

<!-- gh-comment-id:2577595999 --> @novitae commented on GitHub (Jan 8, 2025): > * mitmproxy does TLSKeyLogging for both way: client -> mitmproxy, and mitmproxy -> servers. Do you need both? Yes usually you have to log both
Author
Owner

@NghiaTranUIT commented on GitHub (Jan 8, 2025):

thanks. I will add it. What do you do with this file? These secrets don't link with certain domains, so It's hard to know which domain SSL is.

<!-- gh-comment-id:2577619679 --> @NghiaTranUIT commented on GitHub (Jan 8, 2025): thanks. I will add it. What do you do with this file? These secrets don't link with certain domains, so It's hard to know which domain SSL is.
Author
Owner

@novitae commented on GitHub (Jan 8, 2025):

thanks. I will add it. What do you do with this file? These secrets don't link with certain domains, so It's hard to know which domain SSL is.

Yes I must admit the way it works I a bit confusing, and I couldn't explain to you how it works to find which key is for which connection, but read this you might understand better:

https://wiki.wireshark.org/TLS#Using%20the%20(Pre)-Master-Secret

<!-- gh-comment-id:2577668152 --> @novitae commented on GitHub (Jan 8, 2025): > thanks. I will add it. What do you do with this file? These secrets don't link with certain domains, so It's hard to know which domain SSL is. Yes I must admit the way it works I a bit confusing, and I couldn't explain to you how it works to find which key is for which connection, but read this you might understand better: https://wiki.wireshark.org/TLS#Using%20the%20(Pre)-Master-Secret
Author
Owner

@NghiaTranUIT commented on GitHub (Jan 11, 2025):

@novitae @dabing1022 @swznd @seidnerj Good news: TLS Key Logging is officially supported on this Beta build: https://download.proxyman.io/beta/Proxyman_5.12.2_Support_TLS_Key_Logging.dmg

You can access it in the Tool menu -> TLS Key Logging -> Select your File or Folder.

Screenshot 2025-01-11 at 11 08 12 AM
  • I prefer using UI because macOS app can't read your system env SSLKEYLOGFILE
<!-- gh-comment-id:2585056180 --> @NghiaTranUIT commented on GitHub (Jan 11, 2025): @novitae @dabing1022 @swznd @seidnerj Good news: TLS Key Logging is officially supported on this Beta build: https://download.proxyman.io/beta/Proxyman_5.12.2_Support_TLS_Key_Logging.dmg You can access it in the Tool menu -> TLS Key Logging -> Select your File or Folder. <img width="617" alt="Screenshot 2025-01-11 at 11 08 12 AM" src="https://github.com/user-attachments/assets/7cdf0d3b-297b-4c55-9b01-cc0e28ca1703" /> - I prefer using UI because macOS app can't read your system env `SSLKEYLOGFILE`
Author
Owner

@novitae commented on GitHub (Jan 11, 2025):

Thank you ! I just tried it and decrypted with Wireshark, it works perfectly

<!-- gh-comment-id:2585173129 --> @novitae commented on GitHub (Jan 11, 2025): Thank you ! I just tried it and decrypted with Wireshark, it works perfectly
Author
Owner

@seidnerj commented on GitHub (Jan 11, 2025):

This is awesome!!! Thank you so much @NghiaTranUIT! 🙏

<!-- gh-comment-id:2585206488 --> @seidnerj commented on GitHub (Jan 11, 2025): This is awesome!!! Thank you so much @NghiaTranUIT! 🙏
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Proxyman#1664
No description provided.