Curl Windows: SSL Keylogfile Always Empty Running Powershell

Capturing Master Keys Used in TLS Encryption with curl in PowerShell: Solving the Empty Keylog File Problem

When working with curl in PowerShell, you may encounter a situation where the SSL key log file is always empty, even though you have already downloaded curl and created an alias profile.

Background

To understand this issue, let's first discuss the role of the SSL key log in curl and how it can be used for decrypting TLS traffic.

When using curl to make HTTPS requests, the traffic is encrypted using Transport Layer Security (TLS). To analyze the encrypted traffic, security professionals often use tools like Wireshark or mitmproxy, but these tools require the TLS master keys to decrypt the traffic.

To address this challenge, curl offers a feature to save the TLS master keys to a file, which can later be used by Wireshark or mitmproxy for decryption. This is particularly useful when trying to capture and analyze encrypted traffic on a Windows system.

Problem: Empty SSL Key Log File

Even after setting up the curl profile and creating the SSL key log file, the file remains empty regardless of the number of HTTPS requests made. This behavior is often observed on Windows systems when running curl in PowerShell.

Solution: Using PowerShell to Capture SSL Keys

To solve the empty SSL key log file problem, you can leverage PowerShell capabilities by using the -Verbose flag with curl. This will output the TLS master keys to the PowerShell console instead of a file.

First, make sure you have the latest version of curl installed on your Windows system. Then, follow these steps:

1. Create a PowerShell profile if you don't already have one.
2. Add the curl alias to your PowerShell profile:

3. Run your curl command with the -Verbose flag:

The TLS master keys will now be displayed in the PowerShell console. You can then copy the keys and paste them into a file for later analysis with Wireshark or mitmproxy.

Additional Tips

To make copying the keys easier, you can adjust the PowerShell console buffer size:

1. Open PowerShell.
2. Go to the Properties settings.
3. Increase the Buffer Size as needed.

Even though the default SSL key log file approach for curl might not work on Windows systems running PowerShell, you can use the -Verbose flag to output the TLS master keys directly to the PowerShell console.

• curl: Built-in SSL Ciphers
• Invoke-WebRequest - Microsoft Docs
• Wireshark: Network Protocol Analyzer
• mitmproxy: An interactive, proxy-based tool for man-in-the-middle attacks