CODEWITHSUNDEEP
javassljmeter
StuPointerException
StuPointerException

Reputation: 7267

Import expired SSL certificate into Java keystore

I need to be able to point JMeter at a test server which has an expired SSL certificate (it will be some time before we are able to renew it). JMeter is quite rightly throwing an exception when it tries to connect:

javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
    javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
    at sun.security.ssl.SSLSessionImpl.getPeerCertificates(Unknown Source)
    at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:572)
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180)
    at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:294)
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:640)
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:479)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:805)
    at org.apache.jmeter.protocol.http.sampler.HTTPHC4Impl.sample(HTTPHC4Impl.java:284)
    at org.apache.jmeter.protocol.http.sampler.HTTPSamplerProxy.sample(HTTPSamplerProxy.java:62)
    at org.apache.jmeter.protocol.http.sampler.HTTPSamplerBase.sample(HTTPSamplerBase.java:1075)
    at org.apache.jmeter.protocol.http.sampler.HTTPSamplerBase.sample(HTTPSamplerBase.java:1064)
    at org.apache.jmeter.threads.JMeterThread.process_sampler(JMeterThread.java:426)
    at org.apache.jmeter.threads.JMeterThread.run(JMeterThread.java:255)
    at java.lang.Thread.run(Unknown Source)

Does anybody know of any way that I can import said certificate into the keystore and in the process change the expiry date (and would this even help or would the fact that the server certificate has expired still cause this exception to be thrown)?

I've tried to set the validity as part of the import but this is ignored:

keytool -import ... -validity 100

P.S - I know I could implement my own TrustManager which ignores these checks but my fingers won't allow me to write such evil code and I'd much rather get to a solution that I can install on the server without having to modify JMeter!

Thanks for your time.

Upvotes: 1

Views: 1265

Answers (1)

UBIK LOAD PACK
UBIK LOAD PACK

Reputation: 34536

JMeter does not validate certificate so this is not the cause of your issue.

Which implementation do you use, java, HC3 or HC4 ?

Your issue could come from error in Socket version negotation. Try setting this in user.properties:

  • https.socket.protocols=SSLv2Hello SSLv3 TLSv1

You may have to play with them depending on your server configuration, for example only set this:

  • https.socket.protocols=SSLv3

Upvotes: 3

Related Questions