topic Re: TLS Metadata without decryption in Network Security

TLS Metadata without decryption

JH8286 — Thu, 08 May 2025 14:11:02 GMT

Hello - can FTD/FMC running snort3 collect >TLS1.2 client hello/server cert metadata collection in connection events for example? I do not want to deploy EVE and SSL decrypt is not an option. I just want to capture server cert metadata, SNI etc. Is that possible?

Re: TLS Metadata without decryption

MHM Cisco World — Thu, 08 May 2025 14:16:38 GMT

Tls 1.2 SNI is not encrypt you capture abd check it

Tls 1.3 SNI is encrypt

For cert. I dont know why you want to see it ?

MHM

Re: TLS Metadata without decryption

JH8286 — Thu, 08 May 2025 14:22:52 GMT

How to capture though? Are they displayed in connection events? Server certificate should have SAN/CN/OU in clear at TLS1.2, but not sure if FTD/FMC captures this by default. It may be a snort3 thing, I only have access to snort2 sensors at the moment