Hello all!

There is a web app i'm trying to sniff the connection to programatically.
While searching how can I decrypt the traffic, I came across squid ssl-bump feature.
What i'm trying to do eventually is something very similiar to fiddler, but using squid.

After generating the CERT and KEY using the guide here:

web address:
wirewatcher.wordpress.com/2010/07/20/decrypting-ssl-traffic-with-wireshark-and-ways-to-prevent-it

Everything worked superb and I even managed to see in the squid's log entried the POST & GET requests.

Example:
Yet, I haven't managed to decipher the same rows through Wireshark.

This is the line I used in: edit->prederences->protocols->ssl->rsa_key_list:
<some WAN IP>,8080,http,/home/doron/Desktop/cert3/testkey.pem

My key starts with:
"-----BEGIN RSA PRIVATE KEY-----"

So from my knowledge, it should be in the correct format wireshark can decipher.

I hope some of you could please shed some light on this matter.

After reading the guide, I'm guessing that the certificate you created is not the same certificate used on the web app. I believe this will only work if you have the private key of the server.

From what I understand, the traffic between the client (which is me) and the proxy server is used with the CERT i created.
Even the browser tells and warns me for that reason.
The other session, between the proxy and the WEBAPP is a whole another session that I dont have its key and therefore shouldnt be able to use.

Why then, I cant decipher the traffic between me and the PROXY?

So you have squid configured to perform man-in-the-middle for SSL connections?

Yap, and Iv'e done this using this guide:
wiki.squid-cache.org/Features/SslBump

So is the key /home/doron/Desktop/cert3/testkey.pem the one used on the squid box?

yap, exactly.

maybe you need to change <wan ip> to <squid ip> .. ?

this is the squid's IP.