(By the way, you need the server's private key to do this, of course. The log files will contain the pre-master secret and the shared keys. (Note that the user interface has changed slightly in newer versions of Wireshark, in the way you configure the private key.) If you follow the instructions about decrypting SSL with Wireshark, use the 'SSL debug file' option to store the logs into a file. SSL with decryption keys MCPE/RakNet NDMP Kismet Client/Server protocol Kismet Drone/Server protocol DTLS with decryption keys DTLS JPAKE as used in ThreadGroup Commissioning ETHERNET Powerlink v1 ETHERNET Powerlink v2 Architecture for Control Networks (ACN) Intellon Homeplug (INT51X1) Wifi / Wireless LAN captures / 802. (Note that using Ephemeral Diffie-Hellman isn't the only reason for not seeing a server key exchange message: it could also use a DH_DSS or DH_RSA cipher suite, but this is unusual as far as I know). You can see the encrypted pre-master secret when using RSA authenticated key exchange. You won't see the encrypted shared-key, it's not exchanged.

Wireshark use sslkey