2:31:41:4782 !SecureClientPipeDirect failed: System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. --->
System.ComponentModel.Win32Exception: The specified data could not be decrypted
--- End of inner exception stack trace ---
at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at Fiddler.ClientPipe.SecureClientPipeDirect(X509Certificate2 certServer) in C:\src\Fiddler2\Common\Core\PipeClient.cs:line 161

System.Net Information: 0 : [7588] SecureChannel#33547120::.ctor(hostname=?478, #clientCertificates=0)
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Receive()
System.Net.Sockets Verbose: 0 : [7588] Data from Socket#44866580::Receive
System.Net.Sockets Verbose: 0 : [7588] 00000000 : 16 03 00 00 35 <-- 53 bytes in rest of client hello.                             
System.Net.Sockets Verbose: 0 : [7588] 00000005 : 01 00 00 31 <-- clienthello and 49 bytes in rest of hello

03 00 <- v3

50 C6-30 F9 E9 68 59 6A 20 69 B7 C9 9A 1A C1 A5
2F AB-01 9A A9 96 8C 55 83 B6 60 52 19 73 5B DE <-32bytes of client random

00 <-sessionID Len is 0
00-0A <-cipher len is 10
00 05 00 0A 00 13 00 04 00 FF <-cipher list is 10 ciphers long

01 00 <-- Only null compression

The server then sends the ServerHello:

System.Net Information: 0 : [7588] SecureChannel#33547120 - Locating the private key for the certificate: [Version]
System.Net Information: 0 : [7588] SecureChannel#33547120 - Certificate is of type X509Certificate2 and contains the private key.
System.Net Information: 0 : [7588] AcceptSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = (null), inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitIntegrity)
System.Net Information: 0 : [7588] AcceptSecurityContext(In-Buffer length=58, Out-Buffer length=933, returned code=ContinueNeeded).
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Send()
System.Net.Sockets Verbose: 0 : [7588] Data from Socket#44866580::Send
System.Net.Sockets Verbose: 0 : [7588] 00000000 : 16 03 00 <-- SSL3

03 A0 <-- 928 byte message

02 <-- Server Hello

00 00-4D <-- 77 bytes in message

03 00 <-- Still speaking 3.0

50 C6 30 F9 D2 2C D6 52
5E 4F 5A A9 16-C6 32 24
93 AF 50 3B 76 BE 84 90
C0 76 56 F5 BE-C0 CE 8F <-- 32bytes of server random

20 <-- 32byte session ID

0B 12 00 00 04 1C 51 30
E6 C7 DB E0-89 23 F6 AD
88 13 A8 4D 6C 96 CB 3B
8D C1 15 52-1B AE 42 E6
00 05 00 00 05 FF 01 00 <-- Session ID

01 00 <-- cipher suite (??)

0B <-- Beginning of Certificate message
00-03 47 <-- Message is 839 long

00 03 44 <-- Chain is 836 long

00 03 41 <-- First certificate is 833 long

System.Net.Sockets Verbose: 0 : [7588] 00000060 : 30 82 03 3D 30 82 02 A6-A0 03 02 01 02 02 08 1F : 0..=0...........
System.Net.Sockets Verbose: 0 : [7588] 00000070 : 9C 3A 3F ED A4 CF 08 30-0D 06 09 2A 86 48 86 F7 : .:?....0...*.H..
System.Net.Sockets Verbose: 0 : [7588] 00000080 : 0D 01 01 05 05 00 30 6A-31 2B 30 29 06 03 55 04 : ......0j1+0)..U.
System.Net.Sockets Verbose: 0 : [7588] 00000090 : 0B 0C 22 43 72 65 61 74-65 64 20 62 79 20 68 74 : .."Created by ht
System.Net.Sockets Verbose: 0 : [7588] 000000A0 : 74 70 3A 2F 2F 77 77 77-2E 66 69 64 64 6C 65 72 : tp://www.fiddler
System.Net.Sockets Verbose: 0 : [7588] 000000B0 : 32 2E 63 6F 6D 31 18 30-16 06 03 55 04 0A 0C 0F : 2.com1.0...U....
System.Net.Sockets Verbose: 0 : [7588] 000000C0 : 44 4F 5F 4E 4F 54 5F 54-52 55 53 54 5F 42 43 31 : DO_NOT_TRUST_BC1
System.Net.Sockets Verbose: 0 : [7588] 000000D0 : 21 30 1F 06 03 55 04 03-0C 18 44 4F 5F 4E 4F 54 : !0...U....DO_NOT
System.Net.Sockets Verbose: 0 : [7588] 000000E0 : 5F 54 52 55 53 54 5F 46-69 64 64 6C 65 72 52 6F : _TRUST_FiddlerRo
System.Net.Sockets Verbose: 0 : [7588] 000000F0 : 6F 74 30 1E 17 0D 31 32-31 32 30 33 30 30 30 30 : ot0...1212030000
System.Net.Sockets Verbose: 0 : [7588] 00000100 : 30 30 5A 17 0D 32 32 31-32 31 30 30 30 30 30 30 : 00Z..22121000000
System.Net.Sockets Verbose: 0 : [7588] 00000110 : 30 5A 30 72 31 2B 30 29-06 03 55 04 0B 0C 22 43 : 0Z0r1+0)..U..."C
System.Net.Sockets Verbose: 0 : [7588] 00000120 : 72 65 61 74 65 64 20 62-79 20 68 74 74 70 3A 2F : reated by http:/
System.Net.Sockets Verbose: 0 : [7588] 00000130 : 2F 77 77 77 2E 66 69 64-64 6C 65 72 32 2E 63 6F : /www.fiddler2.co
System.Net.Sockets Verbose: 0 : [7588] 00000140 : 6D 31 18 30 16 06 03 55-04 0A 0C 0F 44 4F 5F 4E : m1.0...U....DO_N
System.Net.Sockets Verbose: 0 : [7588] 00000150 : 4F 54 5F 54 52 55 53 54-5F 42 43 31 29 30 27 06 : OT_TRUST_BC1)0'.
System.Net.Sockets Verbose: 0 : [7588] 00000160 : 03 55 04 03 0C 20 73 63-72 61 62 62 6C 65 66 62 : .U... scrabblefb
System.Net.Sockets Verbose: 0 : [7588] 00000170 : 2D 6C 69 76 65 32 2E 73-6E 2E 65 61 6D 6F 62 69 : -live2.sn.eamobi
System.Net.Sockets Verbose: 0 : [7588] 00000180 : 6C 65 2E 63 6F 6D 30 81-9F 30 0D 06 09 2A 86 48 : le.com0..0...*.H
System.Net.Sockets Verbose: 0 : [7588] 00000190 : 86 F7 0D 01 01 01 05 00-03 81 8D 00 30 81 89 02 : ............0...
System.Net.Sockets Verbose: 0 : [7588] 000001A0 : 81 81 00 88 05 04 D9 20-4D 42 5A 8E DE 2F 28 52 : ....... MBZ../(R
System.Net.Sockets Verbose: 0 : [7588] 000001B0 : 1C A4 46 D6 DA 5F 9C 7A-97 FB AC BD 8C 75 10 D2 : ..F.._.z.....u..
System.Net.Sockets Verbose: 0 : [7588] 000001C0 : DA 61 3B 19 9B 44 87 2A-CF 5B BB 96 57 DE DF 0D : .a;..D.*.[..W...
System.Net.Sockets Verbose: 0 : [7588] 000001D0 : 18 D3 47 94 53 60 E9 64-7A DA 74 AF A8 77 0D 95 : ..G.S`.dz.t..w..
System.Net.Sockets Verbose: 0 : [7588] 000001E0 : 20 54 7D 5C EB 1A 34 EC-FF 98 74 84 78 D4 61 88 : T}\..4...t.x.a.
System.Net.Sockets Verbose: 0 : [7588] 000001F0 : 6E F4 34 33 98 60 1A A0-5F BF 32 14 BB A9 7C 98 : n.43.`.._.2...|.
System.Net.Sockets Verbose: 0 : [7588] 00000200 : 78 D1 7D 16 B0 B6 7C 92-06 70 D7 F3 38 25 99 31 : x.}...|..p..8%.1
System.Net.Sockets Verbose: 0 : [7588] 00000210 : AE 03 30 4F 8B 67 BC 90-59 17 C8 33 42 85 11 3F : ..0O.g..Y..3B..?
System.Net.Sockets Verbose: 0 : [7588] 00000220 : 44 91 D9 02 03 01 00 01-A3 81 E3 30 81 E0 30 81 : D..........0..0.
System.Net.Sockets Verbose: 0 : [7588] 00000230 : A3 06 03 55 1D 23 04 81-9B 30 81 98 80 14 46 67 : ...U.#...0....Fg
System.Net.Sockets Verbose: 0 : [7588] 00000240 : 9D 2C 96 3E 2C 09 83 AC-B7 D9 8F 4B 11 84 20 59 : .,.>,......K.. Y
System.Net.Sockets Verbose: 0 : [7588] 00000250 : 9A 41 A1 6E A4 6C 30 6A-31 2B 30 29 06 03 55 04 : .A.n.l0j1+0)..U.
System.Net.Sockets Verbose: 0 : [7588] 00000260 : 0B 0C 22 43 72 65 61 74-65 64 20 62 79 20 68 74 : .."Created by ht
System.Net.Sockets Verbose: 0 : [7588] 00000270 : 74 70 3A 2F 2F 77 77 77-2E 66 69 64 64 6C 65 72 : tp://www.fiddler
System.Net.Sockets Verbose: 0 : [7588] 00000280 : 32 2E 63 6F 6D 31 18 30-16 06 03 55 04 0A 0C 0F : 2.com1.0...U....
System.Net.Sockets Verbose: 0 : [7588] 00000290 : 44 4F 5F 4E 4F 54 5F 54-52 55 53 54 5F 42 43 31 : DO_NOT_TRUST_BC1
System.Net.Sockets Verbose: 0 : [7588] 000002A0 : 21 30 1F 06 03 55 04 03-0C 18 44 4F 5F 4E 4F 54 : !0...U....DO_NOT
System.Net.Sockets Verbose: 0 : [7588] 000002B0 : 5F 54 52 55 53 54 5F 46-69 64 64 6C 65 72 52 6F : _TRUST_FiddlerRo
System.Net.Sockets Verbose: 0 : [7588] 000002C0 : 6F 74 82 10 00 F7 1A 88-82 F6 66 ED C5 48 D8 71 : ot........f..H.q
System.Net.Sockets Verbose: 0 : [7588] 000002D0 : 83 5F 03 43 30 09 06 03-55 1D 13 04 02 30 00 30 : ._.C0...U....0.0
System.Net.Sockets Verbose: 0 : [7588] 000002E0 : 13 06 03 55 1D 25 04 0C-30 0A 06 08 2B 06 01 05 : ...U.%..0...+...
System.Net.Sockets Verbose: 0 : [7588] 000002F0 : 05 07 03 01 30 18 06 03-55 1D 20 04 11 30 0F 30 : ....0...U. ..0.0
System.Net.Sockets Verbose: 0 : [7588] 00000300 : 0D 06 0B 60 86 48 01 86-F8 45 01 07 17 06 30 0D : ...`.H...E....0.
System.Net.Sockets Verbose: 0 : [7588] 00000310 : 06 09 2A 86 48 86 F7 0D-01 01 05 05 00 03 81 81 : ..*.H...........
System.Net.Sockets Verbose: 0 : [7588] 00000320 : 00 2B 2E 87 67 FC C5 31-2F 3C D6 ED 78 02 76 38 : .+..g..1/<..x.v8
System.Net.Sockets Verbose: 0 : [7588] 00000330 : DD 3D EC 3A D0 98 67 2D-B5 90 26 EE 5C 50 80 7E : .=.:..g-..&.\P.~
System.Net.Sockets Verbose: 0 : [7588] 00000340 : A0 A6 4A 05 74 F4 4C 97-55 52 87 A8 FA 0E 2D E5 : ..J.t.L.UR....-.
System.Net.Sockets Verbose: 0 : [7588] 00000350 : 5F 34 DC 47 0C 08 5F 07-B6 ED D0 DB 21 02 BE E1 : _4.G.._.....!...
System.Net.Sockets Verbose: 0 : [7588] 00000360 : B0 78 64 9D B5 77 09 49-A1 F8 D0 EC 7A 98 35 0C : .xd..w.I....z.5.
System.Net.Sockets Verbose: 0 : [7588] 00000370 : 24 EC F9 C6 A8 AD 90 19-C7 59 B3 A8 EA 7D 7E 0E : $........Y...}~.
System.Net.Sockets Verbose: 0 : [7588] 00000380 : CE 9F C8 D2 11 EA B1 71-B8 7D 71 A6 47 7D 84 14 : .......q.}q.G}..
System.Net.Sockets Verbose: 0 : [7588] 00000390 : 37 5E 9F 4F FA 69 09 23-17 C3 12 B4 34 0C E1 97 : 7^.O.i.#....4...
System.Net.Sockets Verbose: 0 : [7588] 000003A0 : FC 0E

<-- End of certificate

00 00 00 : ..... <-- Unknown 3 bytes on the end...

System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#44866580::Send() -> 933#933
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Receive()

Then

System.Net.Sockets Verbose: 0 : [7588] Data from Socket#44866580::Receive
System.Net.Sockets Verbose: 0 : [7588] 00000000 : 16 03 00 00 84 : ..... <-- SSL3, 132 bytes to come.
System.Net.Sockets Verbose: 0 : [7588] 00000005 : 10 <-- Client key exchange

00 00 80 <-- 128 bytes to come in the key exchange


76 2F 18 86-57 B1 45 2B FB 44 6F 8D 63 A0 A7 46
41 CD 0E AD-E1 16 BC 2E 5E 31 A4 30 52 15 56 59
70 3A 07 AA-64 18 9A CC 70 77 6D 7A CC FD 57 EE
1F 04 E0 FB-B7 FF 2B 5F 2D 02 54 3A 07 04 38 AB
8B E2 8D 84-8F 45 87 30 33 4C 30 7A 16 13 AD AB
13 3D 35 20-44 91 48 46 13 D6 0C 0B 63 AD 8A 98
E0 B2 C6 19-9B 66 4F 86 55 97 FB 0C C0 B2 26 23
AD 7C CD 6B-C5 AF 5F 5B 7B F7 12 2C 48 DB D4 D7 <-- Okay, so there's the premaster secret


We then call AcceptSecurity context...

System.Net Information: 0 : [7588] AcceptSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = 1f273260:2cceedbe40, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitIntegrity)
System.Net Information: 0 : [7588] AcceptSecurityContext(In-Buffer length=137, Out-Buffer length=0, returned code=ContinueNeeded).


Now the Client is meant to send a FINISHED message, the body of which is encrypted.

System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Receive()
System.Net.Sockets Verbose: 0 : [7588] Data from Socket#44866580::Receive
System.Net.Sockets Verbose: 0 : [7588] 00000000 : 14 03 00 00 01 : .....
System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#44866580::Receive() -> 5#5
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Receive()
System.Net.Sockets Verbose: 0 : [7588] Data from Socket#44866580::Receive
System.Net.Sockets Verbose: 0 : [7588] 00000005 : 01 : .
System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#44866580::Receive() -> 1#1
System.Net Information: 0 : [7588] AcceptSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = 1f273260:2cceedbe40, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitIntegrity)
System.Net Information: 0 : [7588] AcceptSecurityContext(In-Buffer length=6, Out-Buffer length=0, returned code=ContinueNeeded).
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Receive()
System.Net.Sockets Verbose: 0 : [7588] Data from Socket#44866580::Receive
System.Net.Sockets Verbose: 0 : [7588] 00000000 : 16 03 00 00 3C : ....<
System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#44866580::Receive() -> 5#5
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Receive()
System.Net.Sockets Verbose: 0 : [7588] Data from Socket#44866580::Receive
System.Net.Sockets Verbose: 0 : [7588] 00000005 : 1B 12 CD EA 86 FF 4D 15-71 BF 08 67 FE C6 82 43 : ......M.q..g...C
System.Net.Sockets Verbose: 0 : [7588] 00000015 : 97 90 B9 E6 3B 09 E6 53-52 85 D3 F0 D5 B2 B5 96 : ....;..SR.......
System.Net.Sockets Verbose: 0 : [7588] 00000025 : A0 0C 8A 24 C4 24 83 BD-7D CA 21 05 EA 53 68 DC : ...$.$..}.!..Sh.
System.Net.Sockets Verbose: 0 : [7588] 00000035 : 1D E5 89 E3 BC AD 87 D2-E3 2F 6F B8 : ........./o.
System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#44866580::Receive() -> 60#60
System.Net Information: 0 : [7588] AcceptSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = 1f273260:2cceedbe40, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitIntegrity)
System.Net Information: 0 : [7588] AcceptSecurityContext(In-Buffer length=65, Out-Buffer length=0, returned code=-2146893008).
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Shutdown(Both#2)
System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#44866580::Shutdown()
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Close()
System.Net.Sockets Verbose: 0 : [7588] Socket#44866580::Dispose()
System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#44866580::Close()
System.Net.Sockets Verbose: 0 : [7588] Socket#38181770::Shutdown(Both#2)
System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#38181770::Shutdown()
System.Net.Sockets Verbose: 0 : [7588] Socket#38181770::Close()
System.Net.Sockets Verbose: 0 : [7588] Socket#38181770::Dispose()
System.Net.Sockets Verbose: 0 : [7588] Exiting Socket#38181770::Close()