Gatling 3.0.1 - JDK SSL issues

Gatling (Open-Source)
1

Hi All,

I am new to Gatling, just installed 3.0.1 version of Gatling and everything works fine.
I had to disable openssl since our target environment doesn’t have openSSL.

When I do that I get a lot of SSL exceptions: ( The same configuration works fine with OpenSSL - local) - Attached.

javax.net.ssl.SSLHandshakeException: General SSLEngine problem
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

—pom.xml–

<properties>
   <java.version>1.8</java.version>
   <netty.version>4.1.32.Final</netty.version>

ssl_error.txt (4.51 KB)

2

Hi,

I am new to Gatling, just installed 3.0.1 version of Gatling and everything works fine.

Latest version is 3.0.2. You should upgrade.

I had to disable openssl since our target environment doesn’t have openSSL.

Gatling ships a statically linked BoringSSL (binaries are available for Linux, MacOS and Windows, all 64bit).
As long as you have one of those architectures, you can use our OpenSSL support.

javax.net.ssl.SSLHandshakeException: General SSLEngine problem
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The most likely reason is that the root CA that issued your server’s certificate is not trusted in your JDK version.
Try upgrading to latest JDK, maybe this CA has been added since u152.

Stéphane Landelle

GatlingCorp CTO
slandelle@gatling.io

3

Thanks for the response Stéphane.

I had to disable openssl since our target environment doesn’t have openSSL.

Gatling ships a statically linked BoringSSL (binaries are available for Linux, MacOS and Windows, all 64bit).
As long as you have one of those architectures, you can use our OpenSSL support.

I think the issue is the the static linked BoringSSL does not work in my target env because it is running Alpine Linux.

javax.net.ssl.SSLHandshakeException: General SSLEngine problem
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The most likely reason is that the root CA that issued your server’s certificate is not trusted in your JDK version.
Try upgrading to latest JDK, maybe this CA has been added since u152.

Sorry I missed to mention that i am using self signed certificates.

Gatling documentations says “Default Gatling TrustStore is very permissive and doesn’t validate certificates, meaning that it works out of the box with self-signed certificates.”

This is true if I use openssl but not when using JDK ssl. Is that a known issue or I am missing something here?
SSL debug logs says the issue is “unknown_certificate” but it doesn’t work even when I specify truststore file via gatling.conf

4

I think the issue is the the static linked BoringSSL does not work in my target env because it is running Alpine Linux.

Alpine shouldn’t be an issue. What you need is x86_64.
You’re out if you have AMD.

Sorry I missed to mention that i am using self signed certificates.

Gatling documentations says “Default Gatling TrustStore is very permissive and doesn’t validate certificates, meaning that it works out of the box with self-signed certificates.”

100% sure Gatling JDK support works out of the box with self signed certs.

This is true if I use openssl but not when using JDK ssl. Is that a known issue or I am missing something here?

SSL debug logs says the issue is “unknown_certificate” but it doesn’t work even when I specify truststore file via gatling.conf

I guess the TLS handshake fails upstream, before even reaching truststore.

Sorry, but that’s as far as I can guess without investigating in your environment, which I can only do with a contract.

Regards,

Stéphane Landelle

GatlingCorp CTO
slandelle@gatling.io

5

You’re out if you have AMD.

Sorry, I meant ARM.

Stéphane Landelle

GatlingCorp CTO
slandelle@gatling.io

6

Hi Aneesh

Did you managed to resolve this issue ? I also got exactly similar ERROR when running my gatling test in nightly pipeline ? Similar test working OK when running it locally on my MAC.

I tried playing with gatling.conf ssl parameter but no LUCK

Please can explain how did you resolved this issue ?

7

Hi Kapil,

I still have the same issue with selfsigned certificates and JDK ssl. No issues if I use openssl.

Regards
Aneesh

8

and how do you config the useOpenssl in your Gradle.build ?

9

Hi,

I have followed all the steps mentioned in the Gatling documentation to configure my Firefox, Chrome & IE browser to record the load test scenario with Gatling.
I am getting Errors like ‘The proxy server is refusing connections’ & ‘Connection timed out’.
I have cross checked my system settings and open ports according to all suggestions i gathered from the internet.