TLS/SSL下AES密钥生成机制及浏览器密钥查询技术问询

Great question—let’s break this down clearly, since TLS key generation is a collaborative process, not a one-sided task. Here’s what you need to know:

First off: neither the browser nor the server generates the AES key alone—they work together to derive it using shared random data and cryptographic algorithms. Here’s the step-by-step flow:

• The client (your browser) generates a random value called the Client Random, sends it to the server.
• The server responds with its own Server Random, plus its TLS certificate (which includes a public key).
• Next comes the key exchange phase, which has two common flavors:
  • RSA-based key exchange: The browser generates a Pre-Master Secret (another random value), encrypts it with the server’s public key (from the certificate), and sends it to the server. Only the server can decrypt this with its private key to get the Pre-Master Secret.
  • ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) key exchange: Both the browser and server generate temporary key pairs. They exchange their public keys, then each uses their own private key and the other’s public key to compute an identical Shared Secret (this is the magic of Diffie-Hellman—no sensitive data is ever transmitted directly).
• Finally, both the browser and server use the Client Random, Server Random, and the Pre-Master/Shared Secret as inputs to a Pseudorandom Function (PRF) (like HKDF in TLS 1.3, or a SHA-based mix in TLS 1.2). This PRF churns out the final session keys, which include the AES encryption key, AES decryption key, and initialization vectors (IVs) needed for secure communication.

The end result? Both sides have the exact same AES keys, but neither ever sent the actual key over the network—this is why TLS is so secure against eavesdropping.

It depends on your use case:

• For regular end users: No. Chrome stores these AES keys in memory with strict protections, and there’s no built-in way to access them through the browser’s UI. This is intentional—exposing session keys would let attackers decrypt your HTTPS traffic if they got hold of them.
• For debugging/development purposes: Yes, but you need to use specific tools and configure Chrome to log the keys:
  1. Set an environment variable called SSLKEYLOGFILE pointing to a file path (e.g., ~/ssl_keys.log on macOS/Linux, C:\ssl_keys.log on Windows).
  2. Restart Chrome—this makes Chrome write all TLS session keys (including AES keys) to the specified log file as you browse.
  3. Use a tool like Wireshark: Go to Edit > Preferences > Protocols > TLS, enter the path to your SSLKEYLOGFILE, and Wireshark will automatically decrypt captured TLS traffic. You can also open the log file directly to see the raw session keys.

Note: This only works on your own machine, where you control Chrome’s startup environment. Also, TLS 1.3 uses a slightly different key log format, but modern versions of Wireshark support it.

内容的提问来源于stack exchange，提问作者Michael wanna know