Apache om Debian 9 (Stretch) uses OpenSSL 1.0.2 (see apache2-bin dependency on libssl1.0), so you can use the approaches documented in that linked post. You can modify the startup script to export LD_PRELOAD=/path/to/libsslkeylog.so and SSLKEYLOGFILE=/tmp/your.keys.
How to do so is dependent on the application. For systemd you could try systemctl edit apache2 to create an override. If it is still a classic sysvinit init script like Apache, try modifying /etc/init.d/apache2 with the above two environment variables. Don't forget the export keyword. Apache no longer seems to use sysvinit scripts, so you must modify the systemd unit file.
This will result in the master secret being written to the file specified by the SSLKEYLOGFILE environment variable. It is not exactly the premaster secret, but you can use it to enable decryption in Wireshark. For more details about the latter, see also https://wiki.wireshark.org/TLS
Depending on your use case, it might be easier to skip modification of the server and tap keys on the client side instead. Firefox and Chromium have built-in support for the SSLKEYLOGFILE environment variable. Newer versions of curl do support that too, but older versions of curl or other applications using OpenSSL require something like the above sslkeylog.sh approach.
Walkthrough
The sslkeylog.so library is specific to the OpenSSL version. Version 1.0.2 (libssl1.0.2 in Debian Stretch) is not compatible with OpenSSL 1.1.0 (libssl1.1 in Debian Stretch). In order to build the library, you need corresponding development header files. These are available through the libssl1.0-dev or libssl-dev packages for respective versions.
Fetching the sources and building the library should be straightforward:
sudo apt install git make gcc libssl1.0-dev
git clone --depth=1 https://git.lekensteyn.nl/peter/wireshark-notes
cd wireshark-notes/src
make
# Optional: install to a specific location. Adjust paths below if you skip this.
sudo install libsslkeylog.so /usr/local/lib/
This produces a libsslkeylog.so file in your current directory. To test whether it works:
$ ./sslkeylog.sh curl https://example.com -sI
CLIENT_RANDOM ... ... <-- expected for TLS 1.2
HTTP/2 200
...
$ ldd /usr/bin/curl | grep ssl
libssl.so.1.0.2 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.2 (0x00007fc5a088d000)
The last command shows which libssl version the program was linked against. We can do something similar for Apache. The primary program (apache2) loads TLS support through a different library though, so we have to check that:
$ ldd /usr/lib/apache2/modules/mod_ssl.so | grep ssl
libssl.so.1.0.2 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.2 (0x00007f8dbb6ed000)
If this shows libssl.so.1.1 for whatever reason, then you would have to sudo apt install libssl-dev instead and rebuild with make -B.
The next step is to modify the systemd unit file for the apache2 service. Execute systemctl edit apache2, this opens an editor for /etc/systemd/system/apache2.service.d/override.conf where you should add:
[Service]
Environment=LD_PRELOAD=/usr/local/lib/libsslkeylog.so
Environment=SSLKEYLOGFILE=/tmp/your.keys
After restarting (sudo systemctl restart apache2) your keys will now be created somewhere in /tmp/systemd-private-*-apache2.service-*/tmp/your.keys. If you would like a shorter path, you could enter something like /home/user/your.keys, but make sure the file is writable by the www-data user.
Make sure to remove this once your testing has completed. I recommend temporarily modifying the client instead to perform this kind of testing. As shown above, sslkeylog.sh also works with clients.
