能否用Wireshark检测自签名证书？如何区分其与有效SSL证书？

Great questions! The short answer is yes—Wireshark absolutely lets you detect self-signed certificates, and there are several straightforward ways to tell them apart from trusted SSL certificates in packet captures. Let’s walk through this clearly.

Absolutely. Wireshark parses every step of the SSL/TLS handshake process, and the certificate exchange is a critical, unencrypted part of that handshake. Even if the rest of the traffic is encrypted, the certificate itself is sent in plaintext during the initial handshake, so Wireshark can capture and analyze it fully.

Here are the most reliable methods to spot the difference:

1. Compare the Certificate Issuer and Subject #

This is the most definitive red flag for self-signed certificates. A self-signed certificate is issued by the same entity it’s meant to authenticate—so the Issuer and Subject fields will be identical (down to the Common Name, Organization, and other details).

To check this in Wireshark:

• Find a TLSvX Record Layer: Handshake Protocol: Certificate packet in your capture.
• Expand the Handshake Protocol: Certificate section, then open the Certificates list.
• Click the first (and often only) certificate, then look for the Issuer and Subject fields.
  • For a self-signed cert: Both will have the same CN (e.g., "localhost" or a custom server name) and organizational details.
  • For a trusted cert: The Issuer will be a recognized CA (like Let’s Encrypt Authority X3, DigiCert Global Root CA), while the Subject will be the domain owner (e.g., "example.com").

2. Inspect the Certificate Chain Length #

Trusted SSL certificates rely on a chain of trust: the end-user certificate is signed by an intermediate CA, which in turn is signed by a root CA. In Wireshark’s Certificate packet, you’ll see 2-3 certificates in the Certificates list (the end-user cert + 1-2 intermediate CAs).

Self-signed certificates have no chain—you’ll only see one certificate in that list, with no intermediate CA entries.

3. Check Wireshark’s Expert Info (When Decrypting Traffic) #

If you can decrypt the SSL/TLS traffic (either by having the server’s private key, or using an SSLKEYLOGFILE for client-side decryption), Wireshark will flag self-signed certificates directly in the Expert Info panel. Look for warnings like:

• "Certificate not trusted"
• "Self-signed certificate"
• "The certificate issuer is unknown"

These warnings don’t appear for trusted certificates that chain back to a root CA in Wireshark’s trusted store.

4. Validate the Certificate’s Validity Period (Secondary Check) #

While not 100% foolproof, self-signed certificates often have extremely long validity periods (sometimes 10+ years) because there’s no CA enforcing short lifespans. Trusted CA-issued certificates, by contrast, typically have lifespans of 90 days to 1 year (per modern industry standards). You can check this in the certificate’s Validity Not Before and Validity Not After fields in Wireshark.

To recap, the most obvious, quick-to-identify markers are:

• Identical Issuer and Subject: The #1 giveaway for self-signed certs.
• Single Certificate in Chain: No intermediate CA entries in the handshake’s Certificate packet.
• Expert Info Warnings: Clear alerts when traffic is decrypted.
• Unusually Long Validity: A strong hint, though not definitive on its own.

Even if you can’t decrypt the full traffic, the first two markers are visible in the unencrypted handshake packet—you don’t need access to keys to spot them.

内容的提问来源于stack exchange，提问作者Robert Zunr