©

2022 ExtraHop Networks, Inc. All rights reserved.

Install the ExtraHop session key forwarder on

a Windows server

Published: 2022-12-08

Perfect Forward Secrecy (PFS) is a property of secure communication protocols that enables short-

term, completely private session key exchanges between clients and servers. ExtraHop offers session

key forwarding software that can send session keys to the ExtraHop system for SSL/TLS decryption.

Communication between the key forwarder and the sensor is encrypted with TLS 1.2, and there is no limit

• Make sure that your server environment is supported by the ExtraHop session key forwarder software:

• Microsoft Secure Channel (Schannel) security package

• Java SSL/TLS (Java versions 8 through 13). Do not upgrade to this version of the session key

forwarder if you are currently monitoring Java 6 or Java 7 environments. Version 7.9 of the

session key forwarder supports Java 6 and Java 7, and is compatible with the latest ExtraHop

firmware.

• Dynamically linked OpenSSL (1.0.x and 1.1.x) libraries. OpenSSL is only supported on Linux

systems with kernel versions 4.4 and later and RHEL 7.6 and later.

• Make sure the server where you install the session key forwarder trusts the SSL certificate of the

ExtraHop sensor.

OpenSSL on Windows is not currently supported.

Important: After you install the session key forwarder software, applications that include SSL-

enabled features, such as EDR agents and Windows Store applications, might fail to

function correctly.

Validate the compatibility of the session key forwarder in your Windows test

environment before deploying in your production environment.

Windows application traffic decryption

The following Microsoft application traffic can be decrypted with the session key forwarder.

• Microsoft IIS

• Microsoft PowerShell

Install the ExtraHop session key forwarder on a Windows server 2

3. Double-click the ExtraHopSessionKeyForwarder.msi file and click Next.

4. Select the box to accept the terms of the license agreement and then click Next.

5. Type the name of the sensor where you want to forward session keys.

6. Accept the default TCP listen port value of 598 (recommended), or type a custom port value and then

click Next.

7. Click Install.

8. When the installation completes, click Finish, and then click Yes to reboot the server.

Command-line installation option

The following steps show you how to install the session key forwarder from a Windows command prompt

or Windows PowerShell.

Where C:\ExtraHopSessionKeyForwarder.msi is the path to the installer file.

If required for your configuration, you can add optional parameters to the command:

For more information, see Installation parameters in the Appendix.

4. When the installation completes, click Yes to reboot the server.

Enable the SSL session key receiver service

4. Click Save.

Install the ExtraHop session key forwarder on a Windows server 3

Add each protocol for the traffic that you want to decrypt with your session key forwarders.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-

hostname-or-IP-address>/admin.

2. In the System Configuration section, click Capture.

3. Click SSL Decryption.

4. In the Private Key Decryption section, clear the Require Private Keys checkbox.

5. In the Global Protocol to Port Mapping section, click Add Global Protocol.

6. From the Protocol drop-down list, select the protocol for the traffic that you want to decrypt.

7. In the Port field, type the number of the port. Type 0 to add all ports.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-

hostname-or-IP-address>/admin.

2. In the System Configuration section, click Capture.

3. Click SSL Shared Secrets.

Validate session key forwarding

Perform these steps to make sure that the installation was successful and the session key forwarder is

forwarding the keys to the ExtraHop system.

1. Log in to the Windows server.

2. Open the Services MMC snap-in. Ensure both services, “ExtraHop Session Key Forwarder” and

ExtraHop Registry Service” show the status as “Running”.

below.

4. If the Services and Event Viewer snap-in do not indicate any issues, apply a workload to the monitored

services and go to the ExtraHop system to verify that secret-based decryption is working.

Install the ExtraHop session key forwarder on a Windows server 4

When the ExtraHop system receives session keys and applies them to decrypted sessions, the Shared

Secret metric counter (in Applications > All Activity > SSL Sessions Decrypted) is incremented. Create

a dashboard chart with this metric to see if the sensor is successfully receiving session keys from the

monitored servers.

Verify the configuration from the command line

Where <eda hostname> is the fully qualified domain name of the sensor you are forwarding secrets

to.

The following output should appear:

If there is a configuration issue, troubleshooting tips appear in the output to help you correct the issue.

Follow the suggestions to resolve the issue and then run the test again.

4. You can optionally test the certificate path and server name override by adding the following options

to the command above.

Install the ExtraHop session key forwarder on a Windows server 5

The ExtraHop system provides key receiver metrics that you can add to a dashboard chart to monitor key

receiver health and functionality.

To view a list of available metrics, click the System Settings icon and then click Metric Catalog. Type key

receiver in the filter field to display all available key receiver metrics.

Integrate the forwarder with the Java-based SSL application

The ExtraHop session key forwarder integrates with Java applications through the -javaagent option.

Consult your application's specific instructions for modifying the Java runtime environment to include the -

javaagent option.

As an example, Apache Tomcat supports customization of Java options in the Tomcat service manager

properties. In the following example, adding the -javaagent option to the Java Options section causes

Install the ExtraHop session key forwarder on a Windows server 6

Install the ExtraHop session key forwarder on a Windows server 7

Install the ExtraHop session key forwarder on a Windows server 8

5. After the software is removed, click Yes to restart the system

and a self-signed or other CA certificate must

be placed into the certificate store manually,

the administrator must import the certificate to

Certificates (Computer Account) > Trusted Root

Certification Authorities on the monitored system.

This parameter is optional if the monitored

server was previously configured to trust the SSL

certificate of the sensor through the Windows

certificate store.

certificate of the sensor, then the forwarder must

be configured with the correct CN.

This parameter is optional.

Install the ExtraHop session key forwarder on a Windows server 9

We recommend that you regenerate the SSL self-

signed certificate based on the hostname from

the SSL Certificate section of the Administration

settings instead of specifying this parameter.

complete. If you specify this parameter you will not

be prompted to restart the system.

This parameter is not recommended.

port remain set to the default of 598.

This parameter is optional.

Supported SSL/TLS cipher suites

The ExtraHop system can decrypt SSL/TLS traffic that has been encrypted with PFS or RSA cipher suites.

All supported cipher suites can be decrypted by installing the session key forwarder on a server and

configuring the ExtraHop system.

Cipher suites for RSA can also decrypt the traffic with a certificate and private key—with or without session

key forwarding.

Decryption methods

The table below provides a list of cipher suites that the ExtraHop system can decrypt along with the

long as you have uploaded the certificate and private key.

RSA + Cert

RSA + Cert