How about using a TLS inspection proxy instead of dumping TLS secrets that have to be post-processed with httpreplay? Some TLS proxies can generate PCAP files with decrypted TLS traffic on the fly.

yes in past i was using mitmproxy for that, but i don't remembe why i dropped it

yes in past i was using mitmproxy for that, but i don't remembe why i dropped it

Maybe mitmproxy didn't provide much value over the current implementation? The TLS traffic and sslkeylogfile.txt from mitmproxy probably still had to be post-processed (decrypted) in order for Suricata to inspect it, right?

as far as i remember, i might be wrong rigth now, mitmdump was dumping decrypted already pcap https://docs.mitmproxy.org/stable/#mitmdump

The one disadvantage with using an inline proxy is some malware could detect on the naming/properties used by the CA.