I will focus on Ruby and the binding for OpenSSL. In this blog post, I will explain how to decrypt SSL/TLS communications to allow for the analysis of that traffic with Wireshark. Our team, responsible for the Trustwave network vulnerability scanning system, regularly encounters this situation - especially when scanning systems we don't control (mostly those of customers). However, this process can be tricky when the communication is encrypted. A common method is capturing the traffic using a packet analyzer tool such as tcpdump or Wireshark. Take the private key and save it on your PC in a filename.key file.Debugging a program that communicates with a remote endpoint usually involves analyzing the network communications. First you need the private key used by Kamailio. On VoipNow 3.5, you can find it in /etc/voipnow/certs/ kamailio.pem.Otherwise, you won't be able to decrypt the capture.

Beside the filters, when you're capturing TLS, you need to make sure you capture the SSL handshake between the phone terminal and the VoipNow server.In the capture, t he encoded packets will appear as TLS. In the capture below, we had a call from phone terminal (A) 192.168.1.225 through the VoipNow server (B) at 10.150.20.27 and towards another phone terminal (C) on UDP at 192.168.3.152. As you can see, the part between A and B is missing because it's using TLS, whereas the communication between B and C occurs on UDP and is visible. When you open the capture, you'll see that the TLS part of the call is not even recognized by Wireshark as SIP.Tcpdump -nni any -s 0 port 5050 or port 5060 or port 5061 -w /usr/local/voipnow/admin/htdocs/tls.pcap

Wireshark decrypt tls