Troubleshoot TLS Handshake Failures using Wireshark

In this video we'll be covering how to troubleshoot some common TLS handshake problems using Wireshark. We'll review what a healthy handshake looks like, then dive into three failure scenarios:
1 - The target server is not running TLS on the specified port
2 - The target server does not accept the client's TLS version or cipher list
3 - The client does not accept the server's TLS certificate
Additional resources:
tls.ulfheim.net/ - An illustrated step-by-step guide to the TLS 1.2 handshake
tools.ietf.org/html/rfc5246 - TLS1.2 RFC (Request for Comments)
www.ssllabs.com/ssltest/ - Tool for testing public-facing TLS servers
badssl.com - Site featuring various misconfigured SSL pages, useful for testing

[@adw1a]

TLS Troubleshooting is explained in detail. The video quality is very good! The references shared are relevant to understanding the topic. Thank you for creating this video.

[@weedee77]

TLS troubleshooting demystified. Very useful information and explained in easy-to-understand manner. Thank you!

[@sureshjoshi5933]

Perfectly explained in a very simple way !! Loved it.

[@gullitlevia787]

So far it's the best video on SSL/TLS. Thank you very much

[@jayshakti8562]

As soon as I saw this video, I immediately hit the subscribe button. I request you please make more videos like this on tls protocols, cryptography algorithms, key exchange algorithms.....and many more in a detailed way 🙏🙏

[@hadestech8147]

Wow… Outstanding classes. I found the content to be very informative, thorough, well covered, and the proper pace for me. Thank you. Great work.

[@plaintextpackets]

I’m glad it was helpful

[@PremKumar-cy4ly]

Perfect explanation, really helped me right now on investigation. Thanks!

[@ThisCanNotBTheFuture]

Excellent lesson. Really hope you'll consider doing more. Maybe, analyzing kerberos, LDAP, etc.?

[@plaintextpackets]

Thanks! I’ve had a crazy busy year but hopefully will do a few more videos soon.

[@supriyamishra1886]

detailed explanation , thank you so much for the video , hope to see more videos on networking in coming days:)

[@SAURABHKUMAR-yw4dd]

One word for your explanation "Awesome"!!!!!

[@ManishYadav0719]

The first website mentioned in the video made my day ❤

[@blahdelablah]

This was excellent, very clearly explained. You've got yourself a new subscriber.

[@plaintextpackets]

Awesome, thank you!

[@aidataverse]

Awesome ,Comprehensive & useful content

[@phillipdane7852]

Easily the best video on TLS. Would love to see something similar but for analyzing TLS renegotiations!

[@plaintextpackets]

Thanks Philip, I’ll add TLS renegotiation to the video list!

[@sureshjoshi5933]

@@plaintextpackets would you be able to create one more vedio on how to apply filters in wireshark for understanding the sequence of packet flow !!

[@masajjad]

@@plaintextpackets enjoyed the hands-on approach and all supporting materials provided in description. by any chance have you published that video? :) eager to see under the microscope of wireshark ... play by play. I'm sure you will nail that one as well. keep up the good work. Thanks for explaining an extremely complex topic in a simple way.

[@plaintextpackets]

I will try to get one out soon. My day job is very busy so I usually make a batch of videos when I have a bit of down time. Thank you for the support!

[@masajjad]

@@plaintextpackets this is epic. "Down time" lol 😆 man you sound like breathe networking

[@sujeetbadnale9441]

Thank You. This is high quality content that too for free. God Bless You. I must say you have demystified many things at once at least for me, like Using Wireshark, TLS etc. Thank you again. Keep creating content. God Bless again.

[@plaintextpackets]

Thank you!

[@akshaydoifode1097]

Awesome explanation and references provided are really helpful Thanks sir🙂

[@ciscoliveciscolive8048]

The best SSL Video Explained

[@plaintextpackets]

Thank you!

[@lienn8032]

Appreciated the detailed easy to understand explanation. Thanks!!!

[@plaintextpackets]

Glad you enjoyed it

[@devart321]

Ohh my god...Nicely explained TLS..Thank you so much :)

[@alikhalidsalim4865]

So helpful. Thanks man. Please post more vids.

[@plaintextpackets]

Hopefully will have time starting January

[@MyVirtualboy]

Great video - thanks for you contribution.

[@helpinghand2508]

Thank you. It helped. stay happy.

[@vikashverma6946]

Amazing content , thanks a lot.

[@devart321]

Expecting few more detailed videos on other topics as well.....Pleasssss

[@plaintextpackets]

Thanks, I’ve been moving so haven’t had time. Hopefully soon.

[@jandg2530]

Thank you for putting this up. Explained it to where i understood everything and was not bored to sleep

[@plaintextpackets]

Thanks!

[@mike_on_tech]

Great video! Thanks

[@linuxlove1912]

Thanks for the video..!!!

[@engbmwa]

many thanks

[@upelister]

Thank you.😊

[@adriantucci6886]

Great video and excellent explanation! Do you have a video explaining what happens when the server trusted ca list doesnt include your certificate?

[@plaintextpackets]

Are you referring to 2-way TLS?

[@adriantucci6886]

@@plaintextpackets Yes

[@ShivamPandey-we4ek]

nice video !!!

[@Themahaaveer]

Please make a video on how to identify encrypted tcp packets from unencrypted ones. I am self hosting rustdesk and in wireshark i cannot see tls handshake or anything related to ciphers. All i see is plain tcp packets. But rustdesk says connection is encrypted when i use keys and unencrypted when i dont use keys. how do i actually make sure it is encrypted in wireshark ? Thanks for making great videos

[@plaintextpackets]

I got you. What port is it running? You’ll only see the handshake when the session starts so if it’s a RDP tool it might keep the session open. You can try restarting the app on your PC while capturing and see if the handshake comes in. If it’s using its own custom protocol it may be difficult to tell if they are really encrypting things but the above may help. Feel free to send me a sample too if you need a second pair of eyes

[@Themahaaveer]

@@plaintextpackets Thanks for the quick reply. Once the connection is established, both clients talk in random ports. I'll try restarting the service to try to capture the handshake. The server uses 5 different ports in 20000 range but I'm using it on 30000 range. I'll capture both unencrypted and encrypted traffic when clients are on remote session. The server uses rendezvous protocol to establish connection between clients.

[@plaintextpackets]

If you'd like feel free to join the discord to troubleshoot further: discord.gg/NrxCCkdZ

[@paulsiny12345]

What does it mean when the server send an encryption alert type 21 before a FIN? Does that mean close notify?

[@aldehc99]

Thanks for this beautiful explanation. When there is a self singed certificate sent by the server, the client can trust it by adding it to the client local cert store, right?, Then I think it is supposed to send the client key exchange to the server.

[@plaintextpackets]

Yep if you add the self signed to your trust store the handshake should go forward as normal

[@mike_on_tech]

@12:00 Why does the Length in the column (~1500 bytes) differ from the message size (the certificates alone show as being nearly 2400 bytes)?

[@plaintextpackets]

The length column in this case is showing the packet length. The certificate length is showing the total size of the cert message, but that gets spanned over multiple packets.

[@senthilkumarramalingam8298]

nice..

[@fabiantoro7146]

Very nice explanation. Something caught my attention: why in the first example the Client Hello packet says "TLSv1" and the rest do say "TLSv1.2"? Is it normal or bad thing? Thank you very much

[@plaintextpackets]

This is a good point. Wireshark will show the TLS version under the 'Record Layer' heading, and also under the 'Handshake Protocol: Client Hello' heading. The version which the client is actually using is the one under 'Handshake Protocol: Client Hello'. This can be confusing, but is a function of how the TLS protocol is constructed.

[@mailman2097]

great

[@nijisworld9341]

Hello, I am unable to access one my application url using chrome, Edge or Firefox. But able to access the same using IE. I took wireshark trace for working and non working scenario. And noticed except IE other browsers are using TLS. 1.0. IE using Tls. 1.2.. Why it is like that?

[@plaintextpackets]

Different browsers have different TLS client compatibility. For example many browsers have now shut off support for TLS 1.0 because it’s considered depreciated, so those browsers will fail when trying to access servers that only support TLS 1.0. If you want to send me the packet capture I can take a look to see if I can help find the root cause.

[@kathytatum2099]

Can you explain this to me? I can connect fine through a regular browser, but when I try and use Webinspect this is what I get: Client Hello (TLS 1.2) Server Ack Server Hello, Certificate (TLS 1.2, Suite (0xc030) *not self signed Server Key Exchange, Certificate Request, Server Hello Done Client Ack Client Fin, Ack Client SYN, ECN, CWR Server Ack Server Fin, Ack I am wondering what could be blocking my certificate being sent when using Webinspect but not when I use Firefox or IE. Ciphers are available on both sides, as I can connect without Webinspect. I know this may be a Webinspect question (already tried with them) but I'm trying to get an outside opinion

[@plaintextpackets]

Sounds like webinspect is not sending your TLS client certificate (since the server is asking for one), or it does not trust the server’s certificate. Either could be true since it’s the client who kills the connection after the server cert. If you can run WI without cert validation enabled you can tell if it’s because of the server certificate.

[@alimohammed817]

hi sir , if I secure sip over TLS by certificate , can any one capture the traffic and decrypt TLS ? if yes , how he can decrypt , what he use ??

[@plaintextpackets]

You can only decrypt TLS if you are using old versions and cipher suites, if you use TLS 1.2 with new ciphers it is impossible for the average person to decrypt.

[@deLuka93]

18:15 important

[@deLuka93]

Just some notes for me, thanks for the great video. :)

[@felipesalvadoriii8159]

hi can i email you? and ask help for my tls issue? thank you

[@plaintextpackets]

That’s fine just send me a private message

[@krunalshah9898]

I have an issue when using mutual authentication i.e 2 way authentication, I get warning: no suitable certificate found - continuing without client authentication

[@plaintextpackets]

Can you post the PCAP or is it sensitive? You can also DM me. Sounds like the client certificate is not installed correctly or maybe has another issue. Do you see the client sending its certificate to the server?

[@krunalshah9898]

@Plaintext Packets I see cert authorities part showing some CN names just before the serverhellodone, and no certificate found error immediately after serverhellodone

[@plaintextpackets]

Do you see a CertificateRequest message coming from the server?

[@krunalshah9898]

​@Plaintext Packets yes there is and also it has cert authorities which has some CN names

[@plaintextpackets]

Ok that’s good, so after that do you see a certificate sent by the client IP, or does the connection close after the server sends its certificate? Also, which IP initiates the FIN?

[@8802082642]

Just what i was looking for. Excellent content and explanation with pcap's. Any idea how I can correspond the TLS session on client side to server side pcap taken in parallel? Any pointer will be welcomed. Thank you for sharing this.

[@plaintextpackets]

Is there a NAT between the client and server?

[@PhucLe-qm9vt]

So far it's the best video on SSL/TLS. Thank you very much

[@plaintextpackets]

You’re welcome!