Wireshark · Wireshark-users: [Wireshark-users] tshark reassembled TLSv1 record: Can it display certificate attributes for each ce

["Magnuson, Steve" <Steve.Magnuson2@xxxxxxxxxx>]

Is there a way to tell tshark to display, for example, x509sat.printableString and x509af.utcTime attributes for each certificate in a certificate chain?  This command will only show the attributes for the first certificate in a certificate chain in a reassembled TLSv1 record:

tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e x509sat.printableString -e x509af.utcTime

In Wireshark, it shows the reassembled certificate chain and you can look at attributes for each certificate, but tshark only shows the attributes for the first certificate - unless I'm missing something.

Thanks,

Steve