Debugging applications that use encrypted communications is difficult because tcpdump or wireshark will only show gibberish. However, wireshark has the ability to use a file with (pre-)master secrets, which will allow it to decrypt the traffic.

I propose to add the option to generate such a file to tcltls. The standard way to do this is by setting the environment variable SSLKEYLOGFILE.

A patch is available [http://www.tclcode.com/patches/tls-b5c41cdeb6-debug.diff|here]