Then open a Terminal and run the following: touch ~ /Desktop/session-key.logĮxport SSLKEYLOGFILE= '~/Desktop/session-key.log' Stop any existing instances of Chrome or Firefox (whichever you're intending to use). Replace en0 with your network interface as reported by ifconfig (OS X) or ip addr (Linux). Got a copy? Let's go: Start capturing packets sudo tcpdump -i en0 -s 0 tcp port https -w ~ /Desktop/capture.pcap Best of all you can use it in conjunction with Chrome or Firefox to inspect SSL traffic incredibly easily. You can enable one environment variable to capture SSL traffic with Wireshark 2 and Chrome/Firefox However if you just want to see the unencrypted contents of your SSL traffic from a web browsing session, and if that browser is Chrome or Firefox, there's a simpler solution. These drawbacks don't stop Charles from being a useful piece of software, and we'll keep Charles around. Sudo keytool -import - alias charles -file /Applications/Charles.app//Contents/doc/charles-proxy-ssl-proxying-certificate.crt -keystore $JAVA_HOME/lib/security/cacerts -storepass somePasswordButMyNotMyActualPassword Keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit | grep charles You need to run: # See if Charles' root certificate is installed Reinstalling Charles' root certificate after OS X updates is boring. Charles requires Java to be installed and enabled.ALL_PROXY is Curl specific #export HTTP_PROXY= export ALL_PROXY= However: Charles has got us out of a bunch of jams before, and we've always kept this around for when we need it: # For Charles Proxy. Charles Proxy is one of the most well known SSL debugging tools.

Wireshark localhost port filter