Problems with using certificates and SSL (long)

[Krzysztof Karnaszewski]

Hi,

i'm using JMeter 1.9.1 to test web application on SSL (Java JRockit
81sp2_141_05 (it has SUN's JSSE). I have problems with certificates. I have 2
two certificates CA certificate and user certificate (Certificates are
generated by OpenCA application). I've serched for solution in group Archives
and Google but I've not find any.

I have registrated CA certificate in $JAVA_HOME/jre/lib/security/jssecacerts
calling following command:

keytool -import -keystore $JAVA_JOME/jre/lib/security/cacerts -file ca.pem

in jmeter.properties I have following entries:
...
ssl.provider=com.sun.net.ssl.internal.ssl.Provider
ssl.pkgs=com.sun.net.ssl.internal.www.protocol
javax.net.ssl.trustStore=$JAVA_HOME/jre/lib/security/jssecacerts
javax.net.ssl.keyStore=$PATH_TO_CLIENT_CERTIFICATE/test.p12
javax.net.ssl.keyStorePassword=my_password
...

My test plan is as simple as it is possible:
1 thread group (1 thread, 1 loop)
1 http request (server ip, protocol https, GET, port 443)
1 listener

when I Start tests I get following log in jmeter.log (real paths are replaced
by xxx) :

03/25/2004 6:21:13 PM INFO - jmeter.JMeter: Version 1.9.1
03/25/2004 6:21:43 PM INFO - jmeter.gui.action.Load: Loading file:
/xxx/test_wpwo.jmx
03/25/2004 6:38:14 PM INFO - jmeter.engine: Running the test!
03/25/2004 6:38:14 PM INFO - jmeter.engine: Starting 1 test threads
03/25/2004 6:38:14 PM INFO - jmeter.engine: Thread Simple1-1 started
03/25/2004 6:38:15 PM INFO - jmeter.util: KeyStore Type: PKCS 12
03/25/2004 6:38:15 PM ERROR - jmeter.util: Couldn't load keystore
java.io.IOException: Set tag error
at
sun.security.util.DerInputStream.getSet(I)[Lsun.security.util.DerValue;(DerInputStream.java:276)
at
com.sun.net.ssl.internal.ssl.PKCS12KeyStore.a(Lsun.security.util.DerInputStream;[C)V(DashoA6275:???
)
at
com.sun.net.ssl.internal.ssl.PKCS12KeyStore.engineLoad(Ljava.io.InputStream;[C)V(DashoA6275:???)
at
java.security.KeyStore.load(Ljava.io.InputStream;[C)V(KeyStore.java:652)
at
org.apache.jmeter.util.keystore.DefaultKeyStore.load(Ljava.io.InputStream;Ljava.lang.String;)V(Defa
ultKeyStore.java:84)
at
org.apache.jmeter.util.SSLManager.getKeyStore()Lorg.apache.jmeter.util.keystore.JmeterKeyStore;(SSL
Manager.java:206)
at
org.apache.jmeter.util.JsseSSLManager.getContext()Lcom.sun.net.ssl.SSLContext;(JsseSSLManager.java:
208)
at
org.apache.jmeter.util.JsseSSLManager.<init>(Ljava.security.Provider;)V(JsseSSLManager.java:136)
at
COM.jrockit.reflect.NativeMethodInvoker.invoke0(ILjava.lang.Object;[Ljava.lang.Object;)Ljava.lang.O
bject;(Native Method)
at
COM.jrockit.reflect.NativeConstructorInvoker.newInstance([Ljava.lang.Object;)Ljava.lang.Object;(Unk
nown Source)
at
java.lang.reflect.Constructor.newInstance([Ljava.lang.Object;I)Ljava.lang.Object;(Unknown
Source)
at
org.apache.jmeter.util.SSLManager.getInstance()Lorg.apache.jmeter.util.SSLManager;(SSLManager.java:
318)
at
org.apache.jmeter.protocol.http.sampler.HTTPSampler.setupConnection(Ljava.net.URL;Ljava.lang.String
;Lorg.apache.jmeter.samplers.SampleResult;)Ljava.net.HttpURLConnection;(HTTPSampler.java:584)
at
org.apache.jmeter.protocol.http.sampler.HTTPSampler.sample(I)Lorg.apache.jmeter.samplers.SampleResu
lt;(HTTPSampler.java:953)
at
org.apache.jmeter.protocol.http.sampler.HTTPSampler.sample(Lorg.apache.jmeter.samplers.Entry;)Lorg.
apache.jmeter.samplers.SampleResult;(HTTPSampler.java:445)
at
org.apache.jmeter.threads.JMeterThread.run()V(JMeterThread.java:277)
at java.lang.Thread.run()V(Unknown Source)
at java.lang.Thread.startThreadFromVM(Ljava.lang.Thread;)V(Unknown
Source)

3/25/2004 6:38:15 PM INFO - jmeter.util: JmeterKeyStore Location:
/xxx/test.p12
03/25/2004 6:38:15 PM INFO - jmeter.util: JmeterKeyStore type: class
org.apache.jmeter.util.keystore.DefaultK
eyStore
03/25/2004 6:38:15 PM INFO - jmeter.util: class
org.apache.jmeter.util.keystore.DefaultKeyStore
03/25/2004 6:38:15 PM INFO - jmeter.util: KeyStore Type: JKS
03/25/2004 6:38:15 PM INFO - jmeter.util: TrustStore Location:
/xxx/jre/lib/security/
jssecacerts
03/25/2004 6:38:15 PM INFO - jmeter.util: TrustStore type: class
org.apache.jmeter.util.keystore.DefaultKeySt
ore
03/25/2004 6:38:15 PM INFO - jmeter.util: AlwaysTrustManager alias: mykey
03/25/2004 6:38:15 PM INFO - jmeter.util: INSTALLED
03/25/2004 6:38:15 PM INFO - jmeter.util: Default Cipher:
SSL_RSA_WITH_RC4_128_MD5
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_RSA_WITH_RC4_128_MD5
03/25/2004 6:38:15 PM INFO - jmeter.util: Default Cipher:
SSL_RSA_WITH_RC4_128_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_RSA_WITH_RC4_128_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Default Cipher:
SSL_RSA_WITH_3DES_EDE_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_RSA_WITH_3DES_EDE_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Default Cipher:
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Default Cipher:
SSL_RSA_WITH_DES_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_RSA_WITH_DES_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Default Cipher:
SSL_DHE_DSS_WITH_DES_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_DHE_DSS_WITH_DES_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Default Cipher:
SSL_RSA_EXPORT_WITH_RC4_40_MD5
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_RSA_EXPORT_WITH_RC4_40_MD5
03/25/2004 6:38:15 PM INFO - jmeter.util: Default Cipher:
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_RSA_WITH_NULL_MD5
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_RSA_WITH_NULL_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_DH_anon_WITH_RC4_128_MD5
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_DH_anon_WITH_DES_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_DH_anon_EXPORT_WITH_RC4_40_MD5
03/25/2004 6:38:15 PM INFO - jmeter.util: Supported Cipher:
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA
03/25/2004 6:38:15 PM INFO - jmeter.util: JsseSSLManager installed


What can be wrong? Can anybody help?

Krzysztof

[Michal Kostrzewa]

Hello Krzysztof,

Post by Krzysztof Karnaszewski
javax.net.ssl.keyStore=$PATH_TO_CLIENT_CERTIFICATE/test.p12
javax.net.ssl.keyStorePassword=my_password
...
03/25/2004 6:38:15 PM INFO - jmeter.util: KeyStore Type: PKCS 12
03/25/2004 6:38:15 PM ERROR - jmeter.util: Couldn't load keystore
java.io.IOException: Set tag error
at
sun.security.util.DerInputStream.getSet(I)[Lsun.security.util.DerValue;(Der

As far as I know, pkcs12 is not supported by sun's jsse very well. For example
it can't write files in this format (j2sdk1.5 will have this implementation
finished). JKS is better supported format.

I'm pretty sure, that the command like:
keytool -list -keystore test.p12 -storetype PKCS12
will result the same error you've got from jmeter:
keytool error: java.io.IOException: Set tag error

You could try to clean up your keystore. Execute commands:
openssl pkcs12 -in test.p12 -clcerts -out file.pem
openssl pkcs12 -export -in file.pem -out clean.p12

and then the command
keytool -list -keystore clean.p12 -storetype PKCS12
should go without error and you can safely use it with jMeter.

best regards
Michal Kostrzewa :)