Take the private key and save it on your PC in a filename.key file.

First you need the private key used by Kamailio. On VoipNow 3.5, you can find it in /etc/voipnow/certs/ kamailio.pem.Otherwise, you won't be able to decrypt the capture. Beside the filters, when you're capturing TLS, you need to make sure you capture the SSL handshake between the phone terminal and the VoipNow server.You should set cipher suites used by RabbitMQ and restrict the list to RSA only. Wireshark enables you to inspect the AMQPS traffic, however you can decrypt only the traffic that have been encrypted using the RSA keys, excluding the RSA ephemeral and Diffie-Hellman Ephemeral (DHE/EDH) cipher suites. In the capture, t he encoded packets will appear as TLS. Inspecting Traffic on TLS-enabled Connections. In the capture below, we had a call from phone terminal (A) 192.168.1.225 through the VoipNow server (B) at 10.150.20.27 and towards another phone terminal (C) on UDP at 192.168.3.152. As you can see, the part between A and B is missing because it's using TLS, whereas the communication between B and C occurs on UDP and is visible. When you open the capture, you'll see that the TLS part of the call is not even recognized by Wireshark as SIP.Tcpdump -nni any -s 0 port 5050 or port 5060 or port 5061 -w /usr/local/voipnow/admin/htdocs/tls.pcap

Wireshark tls decrypt