Decrypt SSL traffic with certificates and private keys

openssl rsa -in yourcert.pem -out new.key

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the System Configuration section, click Capture.
3. Click SSL Decryption.
4. In the Private Key Decryption section, select the checkbox for Require Private Keys.
5. Click Save.
6. In the Private Keys section, click Add Keys.
7. In the Add PEM Certificate and RSA Private Key section, enter the following information:

   Name

   A descriptive name to identify this certificate and key.

   Enabled

   Clear this checkbox if you want to disable this SSL certificate.

   Certificate

   The public key certificate.

   Private Key

   The RSA private key.

8. Click Add.

PKCS#12/PFX files are archived in a secure container on the ExtraHop system and contains both public and private key pairs, which can only be accessed with a password.

keytool -importkeystore -srckeystore javakeystore.jks -destkeystore 
pkcs.p12 -srcstoretype jks -deststoretype pkcs12

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the System Configuration section, click Capture.
3. Click SSL Decryption.
4. In the Private Key Decryption section, select the checkbox for Require Private Keys.
5. Click Save.
6. In the Private Keys section, click Add Keys.
7. In the Add PKCS#12/PFX File With Password section, enter the following information:

   Description

   A descriptive name to identify this certificate and key.

   Enabled

   Clear this checkbox to disable this SSL certificate.

8. Next to PKCS#12/PFX file, click Choose File.
9. Browse to the file and select it, then click Open.
10. In the Password field, type the password for the PKCS#13/PFX file.
11. Click Add.
12. Click OK.

You must add each protocol that you want to decrypt for each uploaded certificate.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the System Configuration section, click Capture.
3. Click SSL Decryption.
4. In the Protocol to Port Mapping by Key section, click Add Protocol.
5. On the Add Encrypted Protocol page, enter the following information:

   Protocol

   From the drop-down list, select the protocol you want to decrypt.

   Key

   From the drop-down list, select an uploaded private key.

   Port

   Type the source port for the protocol. By default this value is set to 443, which specifies HTTP traffic. Specify 0 to decrypt all protocol traffic.

6. Click Add.