Debugging applications that use encrypted communications is difficult because tcpdump or wireshark will only show gibberish. However, wireshark has the ability to use a file with (pre-)master secrets, which will allow it to decrypt the traffic.

I propose to add the option to generate such a file to tcltls. The standard way to do this is by setting the environment variable SSLKEYLOGFILE.

A patch is available here

This feature request was added in commit [2c773b9a38b5e26e] and merged in commit [bed86d33036e5ba3].