[Bro] Capturing the SSL cert via HTTP Connect Method

John B. Althouse III sudo.darkstar at gmail.com
Mon Oct 5 14:59:55 PDT 2015


Has anyone come up with a way to get Bro to capture the SSL cert details
when it's over a HTTP Connect tunnel? Attached is a sample PCAP.

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20151005/41b3de41/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 151005-93OevfuI6-RCPI4P1roPumvw.pcap
Type: application/octet-stream
Size: 6776 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20151005/41b3de41/attachment.obj 


More information about the Bro mailing list