1# Debugging SSL on Linux 2 3To help anyone looking at the SSL code, here are a few tips I've found handy. 4 5[TOC] 6 7## Logging 8 9There are several flavors of logging you can turn on. 10 11* `SSLClientSocketImpl` can log its state transitions and function calls 12 using `base/logging.cc`. To enable this, edit 13 `net/socket/ssl_client_socket_impl.cc` and change `#if 1` to `#if 0`. See 14 `base/logging.cc` for where the output goes (on Linux, usually stderr). 15 16* `HttpNetworkTransaction` and friends can log its state transitions using 17 `base/trace_event.cc`. To enable this, arrange for your app to call 18 `base::TraceLog::StartTracing()`. The output goes to a file named 19 `trace...pid.log` in the same directory as the executable (e.g. 20 `Hammer/trace_15323.log`). 21 22## Network Traces 23 24http://wiki.wireshark.org/SSL describes how to decode SSL traffic. Chromium SSL 25unit tests that use `net/base/ssl_test_util.cc` to set up their servers always 26use port 9443 with `net/data/ssl/certificates/ok_cert.pem`, and port 9666 with 27`net/data/ssl/certificates/expired_cert.pem` This makes it easy to configure 28Wireshark to decode the traffic: do 29 30Edit / Preferences / Protocols / SSL, and in the "RSA Keys List" box, enter 31 32 127.0.0.1,9443,http,<path to ok_cert.pem>;127.0.0.1,9666,http,<path to expired_cert.pem> 33 34e.g. 35 36 127.0.0.1,9443,http,/home/dank/chromium/src/net/data/ssl/certificates/ok_cert.pem;127.0.0.1,9666,http,/home/dank/chromium/src/net/data/ssl/certificates/expired_cert.pem 37 38Then capture all tcp traffic on interface lo, and run your test. 39