# \[GATLING 2\] SSL handshake\_failures **URL:** \ **Category:** Gatling (Open-Source)\ **Created:** [June 10, 2013, 10:43am UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423 "2013-06-10T10:43:44Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 10, 2013, 10:43am UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/1 "2013-06-10T10:43:44Z")
After upgrading to gatling 2 (the snapshot kindly created by Stephane - 2.0.0.20130605) we’re seeing quite a few SSL handshake failures. We used to get som in gatling 1.5.1 too, but we get far more now, so it is probably a client issue. Stefan 12:38:19.294 [WARN] i.g.h.a.AsyncHandler - Request ‘Service call’ failed javax.net.ssl.SSLException: Received fatal alert: handshake\_failure at sun.security.ssl.Alerts.getSSLException(Alerts.java:208) ~[na:1.7.0\_04] at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1639) ~[na:1.7.0\_04] at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1607) ~[na:1.7.0\_04] at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1776) ~[na:1.7.0\_04] at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1080) ~[na:1.7.0\_04] at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:884) ~[na:1.7.0\_04] at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:758) ~[na:1.7.0\_04] at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[na:1.7.0\_04] at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1225) [netty-3.6.6.Final.jar:na] Wrapped by: java.net.ConnectException: Received fatal alert: handshake\_failure to [https://whereever.no/service](https://whereever.no/service) at com.ning.http.client.providers.netty.NettyConnectListener.operationComplete(NettyConnectListener.java:103) ~[async-http-client-1.7.18.20130605.jar:na] at org.jboss.netty.channel.DefaultChannelFuture.notifyListener(DefaultChannelFuture.java:427) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.DefaultChannelFuture.notifyListeners(DefaultChannelFuture.java:413) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.DefaultChannelFuture.setFailure(DefaultChannelFuture.java:380) [netty-3.6.6.Final.jar:na] at org.jboss.netty.handler.ssl.SslHandler.setHandshakeFailure(SslHandler.java:1417) [netty-3.6.6.Final.jar:na] at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1293) [netty-3.6.6.Final.jar:na] at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:913) [netty-3.6.6.Final.jar:na] at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425) [netty-3.6.6.Final.jar:na] at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:109) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:312) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:90) [netty-3.6.6.Final.jar:na] at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) [netty-3.6.6.Final.jar:na] at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) [netty-3.6.6.Final.jar:na] at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) [netty-3.6.6.Final.jar:na] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110) [na:1.7.0\_04] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603) [na:1.7.0\_04] at java.lang.Thread.run(Thread.java:722) [na:1.7.0\_04] ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 10, 2013, 12:35pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/2 "2013-06-10T12:35:07Z")
As you see with this stacktrace, this is pure regular Netty code. Could you provide some more information about your env so that I can open an issue there, please? JDK, OS, application under stress and everything you think meaningful. ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 10, 2013, 12:43pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/3 "2013-06-10T12:43:49Z")
Have you tried upgrading your JDK? ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 10, 2013, 12:50pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/4 "2013-06-10T12:50:42Z")
Did you pass a custom trust or key manager? ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 11, 2013, 7:50am UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/5 "2013-06-11T07:50:42Z")
Hi, The certificate that is used by the server is issued using a certificate java doesn’t trust by default. We’ve not set up a custom trust store, however I don’t see any warnings - which is kinda weird, right? We’ve seen this issue both on windows and linux and different versions of java (1.7.0\_19 linux and 1.7.05-b06 windows) Any ideas? ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 11, 2013, 9:15am UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/6 "2013-06-11T09:15:48Z")
I think I know why you see more of those: we have disabled AHC’s retry feature by default (see gatling.conf file: [https://github.com/excilys/gatling/commit/ce9e33e5f32c9bf3e3c1e5769c310aba94be4a9b](https://github.com/excilys/gatling/commit/ce9e33e5f32c9bf3e3c1e5769c310aba94be4a9b)). So I guess the problem was always here but was hidden. ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 11, 2013, 10:30am UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/7 "2013-06-11T10:30:45Z")
Yep. That helped. Probably a threading issue. ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 11, 2013, 10:49am UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/8 "2013-06-11T10:49:32Z")
So, no longer handshake failures, nor 505, nor slowdowns? ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 11, 2013, 11:27am UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/9 "2013-06-11T11:27:33Z")
BTW, do your 505 problems also happen on HTTP? I realized that zero-copy is disabled over HTTPS. ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 11, 2013, 3:09pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/10 "2013-06-11T15:09:09Z")
I’ve only seen it happen using https When I ran through Charles I used http so that might have been the reason why it worked Stefan ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 11, 2013, 3:10pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/11 "2013-06-11T15:10:28Z")
No more ssl handshake issues. The 505 thing is a different issue. ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 11, 2013, 3:45pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/12 "2013-06-11T15:45:44Z")
I’ll have to clean up this part of AHC. Stay tuned. And thanks for your patience… ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 26, 2013, 1:08pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/13 "2013-06-26T13:08:23Z")
I’ve been investigating the ssl issue a bit I’ve looked at the ahc and netty code, but it’s hard to grasp what’s going on. Apparently one can get ssl debug info using -Djavax.net.debug=ssl,handshake on both client and server. I’ll give it a shot within the next few days. Stefan ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 27, 2013, 1:33pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/14 "2013-06-27T13:33:52Z")
Hi Stefan, Could you sum up the situation, please? IIRC, you had 2 different kinds of problems: - requests being “mixed”, bodies being send from a given user actually being sent from another one - SSL handshake issues I had you try different strategies: passing a file, and passing a byte array read from the file. What is the outcome of the different combinations? Are requests being also mixed over HTTP? Cheers, Stéphane ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 27, 2013, 1:57pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/15 "2013-06-27T13:57:32Z")
See inline comments > Hi Stefan, > > Could you sum up the situation, please? > > IIRC, you had 2 different kinds of problems: Yes > - requests being “mixed”, bodies being send from a given user actually being sent from another one No exactly right. It seems like the request is not flushed correctly after passing a raw data to http.post. When the connection is reused by the same user in the next request, we get a 505. However, if we introduce a pause of 1 sec between these two requests, we never get any 505s. > - SSL handshake issues We’re seeing quite a few of these, but after we increased the retry count, the situation has improved a lot > I had you try different strategies: passing a file, and passing a byte array read from the file. > > What is the outcome of the different combinations? File-\>505 Byte array-\>ok We ended up introducing the short pause to keep the code clean > Are requests being also mixed over HTTP? Yes indeed > Cheers, > > Stéphane Sorry for being unclear before. Hth. Stefan ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 27, 2013, 2:00pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/16 "2013-06-27T14:00:14Z")
Btw, requests are not being mixed when I pass them through Charles ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 27, 2013, 2:05pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/17 "2013-06-27T14:05:57Z")
AHC body parts code is eminently complex: strategies are different according to the part type (file or string or bytes) and the protocol (in HTTP, it tries to perform zero-copy and write directly into the socket from the file Channel, but it doesn’t over over HTTP). I’ll try to clean up all this and come up with a prototype. Thank you for summing up, I’m doing too many things and started losing track. Stay tuned, Stéphane ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 28, 2013, 10:07am UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/18 "2013-06-28T10:07:53Z")
hhm, I tried reproducing the ssl handshake issue using a way simpler simulation without multipart requests - but couldn’t. Maybe the 505 issue is related after all? I’ll keep you posted. ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [June 28, 2013, 12:16pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/19 "2013-06-28T12:16:24Z")
I just produced a new timestamp: 2.0.0.20130628 You should no longer get the NPE. ---
**Author:** ![Stefan\_Magnus\_Landro](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Stefan\_Magnus\_Landro](https://community.gatling.io/u/Stefan_Magnus_Landro)\ **Post date:** [June 28, 2013, 12:30pm UTC](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423/20 "2013-06-28T12:30:15Z")
Perfect. Works like expected. Thanks. [Next page](https://community.gatling.io/t/gatling-2-ssl-handshake-failures/423.md?page=2)