<div class="post-toc-block float-default with-border"> 
						<div class="post-toc-header">Table of Contents</div>
						<nav id="md-post-toc" class="md-post-toc"></nav>
						</div><p>Man-in-the-middle attacks are elegantly mitigated in TLS, with TLS1.3 introducing more robust encryption protocols and a streamlined handshake process that significantly reduces the vulnerability to these types of attacks. By employing stricter encryption standards and eliminating outdated cipher suites, TLS 1.3 enhances security measures to effectively counter potential interception and unauthorised data decryption. This upgrade to the TLS protocol ensures a higher level of confidentiality and integrity of data in transit, making it more challenging for attackers to exploit communication channels.</p>
<p>SSL (Secure Sockets Layer) inspection, also known as TLS (Transport Layer Security) inspection, plays a critical role in network security. It involves the interception and decryption of encrypted traffic to allow for deep packet inspection (DPI). By examining the contents of encrypted SSL/TLS traffic, organisations can identify and mitigate potential security threats like malware, data ex-filtration, and unauthorised access that might otherwise remain hidden.</p>
<p><a href="http://keploy.io">Keploy.io</a> integrates seamlessly with applications that use OpenSSL for secure communication, enabling reliable and secure <a href="https://keploy.io/blog/community/test-case-generation-for-faster-api-testing">API test generation</a>.<br />
By capturing traffic from OpenSSL-enabled services, Keploy can generate accurate test cases without compromising encryption or data integrity.<br />
This makes Keploy an ideal choice for teams building secure, high-performance APIs with TLS/SSL layers powered by OpenSSL.</p>
<h2><strong>SSL Inspection Techniques</strong></h2>
<p>SSL Inspection can be done in multiple ways:</p>
<p><strong>1. Man-in-the-Middle (MitM) Proxy</strong><br />
In this method, the proxy intercepts the TLS handshake and establishes separate TLS connections with both the client and the server. For this to work, the client must trust the proxy’s certificate, which may not always be feasible in production environments or BYOD networks.</p>
<p><strong>2. SSL Decryption with Uprobes</strong><br />
An advanced method involves the use of uprobes (user-space probes) attached to OpenSSL functions like SSL_write or SSL_read, capturing plaintext data or extracting session keys needed to decrypt the traffic. This method does not interfere with the TLS handshake and allows the proxy to decrypt the data without initiating a new TLS connection.</p>
<p>This approach is particularly useful for debugging encrypted traffic or building passive inspection tools. It requires OpenSSL to be present on the system, and it’s supported on multiple platforms, including Linux and Windows. For developers looking to experiment with this, OpenSSL for Windows can be easily set up by downloading the latest precompiled binaries. Many developers use openssl s_client on Windows or Linux to verify server certificates or test SSL/TLS connections from the command line after installing OpenSSL.</p>
<h3><strong>Key Extraction Workflow</strong></h3>
<p>To extract the keys using a uprobe on SSL_write, the first argument to the function (the SSL context) is accessed using the bpf_probe_read_user helper. The SSL context is a private struct inside OpenSSL.</p>
<pre><code>python
// ssl_st-&gt;version
#define SSL_ST_VERSION 0x0   
// Reading ssl_st_ptr
void ssl_st_ptr = (void )PT_REGS_PARM1_CORE(ctx);
__u64 ssl_version_ptr = (__u64 )(ssl_st_ptr + SSL_ST_VERSION);
int ret = bpf_probe_read_user(&amp;version, sizeof(version), (void *)ssl_version_ptr);</code></pre>
<p>This code extracts the TLS version number from the context. Similarly, other fields such as cipher_id, client_random, handshake_secret, and exporter_master_secret can also be extracted by calculating their respective offsets.</p>
<p>Once the secrets are collected, they are pushed into a perf buffer so they can be read in userspace. The key extraction process is designed to work with the proxy, which uses the secrets to decrypt traffic without generating new certificates. This is crucial in setups where the proxy&#8217;s certificate is not trusted by the client.</p>
<h3><strong>Complete Flow of SSL Inspection with Uprobes</strong></h3>
<ul>
<li>
<p><strong>Client Application:</strong><br />
Sends data over TLS using SSL_write, with the OpenSSL library managing encryption.</p>
</li>
<li>
<p><strong>Uprobe Hook on OpenSSL:</strong><br />
A uprobe is attached to SSL_write. When triggered, it reads the SSL context and extracts encryption keys.</p>
</li>
<li>
<p><strong>Perf Buffer:</strong><br />
These secrets are passed from kernel to userspace through a high-speed perf buffer.</p>
</li>
<li>
<p><strong>Proxy:</strong><br />
Listens for encrypted traffic from the client and uses the extracted secrets to decrypt it. Once decrypted, the payload is re-encrypted (if needed) and sent to the server. The proxy doesn’t perform a TLS handshake or use its own certificate.</p>
</li>
<li>
<p><strong>Server:</strong><br />
Receives the decrypted traffic, processed as if it came from a legitimate TLS session.</p>
</li>
<li>
<p><strong>Data Store (Optional):</strong><br />
The decrypted payload may be stored for further analysis, inspection, or compliance auditing.  </p>
</li>
</ul>
<p><strong>Getting Started with OpenSSL: Download and Installation</strong></p>
<p>If you&#8217;re establishing a secure development or inspection environment, the first thing to do is acquire the appropriate tools, beginning with OpenSSL. It&#8217;s easy enough to do, and an OpenSSL download is easily found for every major platform—Windows, macOS, and Linux. Whether you&#8217;re conducting SSL certificate verification, decrypting encrypted traffic for debugging purposes, or adding OpenSSL to your application, having the updated version installed provides access to the newest security standards and functionalities. Windows users can download precompiled binaries from reputable sites such as [SLProweb](<a href="https://slproweb.com/products/Win32OpenSSL.html">https://slproweb.com/products/Win32OpenSSL.html</a>), whereas macOS users can install it seamlessly through Homebrew.</p>
<h3><strong>Getting Started with OpenSSL for Windows</strong></h3>
<p>If you&#8217;re working in a Windows environment and want to try this out or inspect TLS sessions manually, installing OpenSSL is straightforward. You can download OpenSSL for Windows and use the included openssl s_client utility to interact with secure endpoints. This tool is invaluable for debugging and validating your inspection pipeline—whether you&#8217;re working on certificate pinning, handshake validation, or traffic inspection.</p>
<p>By leveraging OpenSSL’s low-level internals with uprobes and eBPF, this approach to SSL inspection offers a powerful, transparent method of monitoring TLS traffic—without needing to manipulate the handshake or insert untrusted certificates. Whether you&#8217;re on Linux or Windows, getting started with OpenSSL tools and utilities opens the door to robust observability of encrypted communication. </p>
<h2>Conclusion</h2>
<p>OpenSSL is still a foundational element of contemporary digital security, driving encryption and safe communications throughout millions of applications and systems. Whether you&#8217;re auditing SSL/TLS traffic, handling certificates, or <a href="https://keploy.io/blog/community/code-quality-with-automated-tools">writing secure code</a>, knowing and leveraging OpenSSL is critical. With simple installation packages available for Windows, Linux, and <a href="https://keploy.io/blog/community/tips-macbook-with-touch-bar-users">macOS,</a> it&#8217;s easy to get started for developers and security experts alike. By remaining current and familiarizing yourself with utilities such as <code>openssl s_client</code> and uprobe-based key extraction, you can better see and control encrypted traffic in today&#8217;s advanced threat environment.</p>
<h2><strong>FAQ’S</strong></h2>
<h3>What is OpenSSL?</h3>
<p>OpenSSL is an open-source library that offers cryptographic functions for encrypting data transmission.</p>
<p>It supports SSL and TLS protocols for secure communication over networks.</p>
<p>Developers utilize it for implementing HTTPS, certificate generation, and key management.</p>
<p>It&#8217;s used extensively in servers, clients, and embedded systems for secure communication.</p>
<h3>How to install OpenSSL on Windows?</h3>
<p>Download the latest OpenSSL installer from a reliable source such as slproweb.com.</p>
<p>Run the installer and accept the default settings, making the recommended selections.</p>
<p>Add the installation directory to your system&#8217;s environment variables for command-line execution.</p>
<p>Open Command Prompt after installing and type <code>openssl</code> to verify it runs.</p>
<h3>How to upgrade OpenSSL 3.1 in Ubuntu 22.04?</h3>
<p>Remove the current version first using <code>sudo apt remove openssl</code>.</p>
<p>Download and extract the OpenSSL 3.1 source code from the official webpage.</p>
<p>Run <code>./config</code>, followed by <code>make</code> and <code>sudo make install</code> to compile and install it.</p>
<p>Finally, check for the upgrade using <code>openssl version</code> in the terminal.</p>
<h3>How to install OpenSSL?</h3>
<p>On Linux, use <code>sudo apt install openssl</code> for rapid installation using the package manager.</p>
<p>On macOS, install Homebrew using <code>brew install openssl</code>.</p>
<p>For Windows, install using the installer downloaded and executed with default options.</p>
<p>On completion of installation, check if it is properly configured using <code>openssl version</code>.</p>

         
        
                    

                    
                    <div class="pp-multiple-authors-boxes-wrapper pp-multiple-authors-wrapper pp-multiple-authors-layout-boxed multiple-authors-target-the-content box-post-id-16 box-instance-id-1 ppma_boxes_16"
                    data-post_id="16"
                    data-instance_id="1"
                    data-additional_class="pp-multiple-authors-layout-boxed.multiple-authors-target-the-content"
                    data-original_class="pp-multiple-authors-boxes-wrapper pp-multiple-authors-wrapper box-post-id-16 box-instance-id-1">
                                                                                    <h2 class="widget-title box-header-title">Author</h2>
                                                                            <span class="ppma-layout-prefix"></span>
                        <div class="ppma-author-category-wrap">
                                                                                                <span class="ppma-category-group ppma-category-group-">
                                                                                                                        <ul class="pp-multiple-authors-boxes-ul">
                                                                                                                                                                                                                                                                                                                                                                                                                    <li class="pp-multiple-authors-boxes-li author_index_0 author_chinmaya-sharma has-avatar">
                                                                                                                                                                                                                                            <div class="pp-author-boxes-avatar">
                                                                                                                                            <img alt='Chinmaya Sharma' src='https://wp.keploy.io/wp-content/uploads/2024/10/Gravatar-Logo.jpg' srcset='https://wp.keploy.io/wp-content/uploads/2024/10/Gravatar-Logo.jpg' class='multiple_authors_guest_author_avatar avatar' height='80' width='80'/>                                                                                                                                    </div>
                                                            
                                                            <div class="pp-author-boxes-avatar-details">
                                                                                                                                                                                                <div class="pp-author-boxes-name multiple-authors-name">
                                                                        <a href="https://wp.keploy.io/author/chinmaya-sharma/" rel="author" title="Chinmaya Sharma" class="author url fn">Chinmaya Sharma</a> 
                                                                    </div>
                                                                                                                                                                                                                                                                    <p class="pp-author-boxes-description multiple-authors-description">
                                                                                                                                            </p>
                                                                                                                                
                                                                                                                                
                                                                                                                            </div>
                                                                                                                                                                                                                                                                                                                                                                                                             </li>
                                                                                                                                                                                                                                    </ul>
                                                                            </span>
                                                                                    </div>
                    <span class="ppma-layout-suffix"></span>
                    </div>
                    
                    
                
                                <style>
                .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { width: 80px !important; height: 80px !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { border-style: none !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-avatar img { border-radius: 50% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-meta a:hover { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { border-radius: 100% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_email-profile-data { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { background-color: #655997 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { border-radius: 100% !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .ppma-author-user_url-profile-data { color: #ffffff !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-author-boxes-recent-posts-title { border-bottom-style: dotted !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-style: solid !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-width: 1px !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { border-color: #999 !important; } .pp-multiple-authors-boxes-wrapper.box-post-id-16.pp-multiple-authors-layout-boxed.multiple-authors-target-the-content.box-instance-id-1 .pp-multiple-authors-boxes-li { color: #3c434a !important; }             </style>

Key Extraction by uprobe Attachment on OpenSSL for SSL Inspection

Protocol Parsing Guide: From Packets to Structured Data

eBPF for TLS Traffic Tracing: Secure & Efficient Observability

Docker Containers: Enabling SSL for Secure Databases

Exploring Various Protocols : HTTP to Databases

Understanding HTTP and HTTPS for Secure Web Communication

Building Keploy.io, an EBPF based open source framework to generate test cases and data stubs from API calls.

Neha Gupta

Cloud technology veteran and probably the youngest (globally) to have completed all 5 AWS certifications (including Solutions architect Professional and Dev­ops engineer professional)

Key Extraction By Uprobe Attachment On Openssl For Ssl Inspection

More Stories