The main point is to save the SSL/TLS keys those used by the web browser (`SSLKEYLOGFILE=/tmp/tmp-google/.ssl-key.log`). In the example below we run brand new instance of Google Chrome (`--user-data-dir=/tmp/tmp-google` do the trick): `SSLKEYLOGFILE=/tmp/tmp-google/.ssl-key.log /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --user-data-dir=/tmp/tmp-google` Then run the Wireshark and open the Preferences -> Protocols -> SSL, where we put the path to the SSL keys log file into the `(Pre)-Master-Secret log filename` field. Now all SSL/TLS traffic from this browser instance will be decrypted.