# HTTPS client certificate configuration **URL:** \ **Category:** Gatling (Open-Source)\ **Created:** [April 29, 2013, 4:04pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348 "2013-04-29T16:04:44Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Jean-Baptiste\_Reich](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@Jean-Baptiste\_Reich](https://community.gatling.io/u/Jean-Baptiste_Reich)\ **Post date:** [April 29, 2013, 4:04pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/1 "2013-04-29T16:04:44Z")
Hi, I would like to configure Gatling in order to have an HTTPS client certificate per user. I saw the keyStore and trustStore configuration in gatling.conf but in my case I really need to specify it per user. Is there a way to do that ? With a feeder for example ? Thanks ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [April 29, 2013, 4:14pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/2 "2013-04-29T16:14:40Z")
You can’t, the AsyncHttpClient engine is shared amongst users. What’s your use case exactly? I have the feeling that you’re looking for some beyond web apps load testing… Networks? If so, people tend to implement their own protocol support and ship it Gatling orchestration engine. ---
**Author:** ![Jean-Baptiste\_Reich](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@Jean-Baptiste\_Reich](https://community.gatling.io/u/Jean-Baptiste_Reich)\ **Post date:** [April 29, 2013, 4:35pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/3 "2013-04-29T16:35:05Z")
My use case is to test an HTTP REST application in which each user have a unique SSL client certificate. This is important because users are authenticated with it and access their private data. I cannot test my application with only one client certificate because I will only be able to access one account which is not representative of my application usage. If the only way to do that is to implement a custom protocol then I will try to Thanks ---
**Author:** ![Philippe\_Bossu](https://avatars.discourse-cdn.com/v4/letter/p/b2d939/32.png) [@Philippe\_Bossu](https://community.gatling.io/u/Philippe_Bossu)\ **Post date:** [April 30, 2013, 5:46am UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/4 "2013-04-30T05:46:18Z")
Hello, I this case maybe you could use alternative tools like JMeter which allows https client certificate per user. Regards ---
**Author:** ![Philippe\_Bossu](https://avatars.discourse-cdn.com/v4/letter/p/b2d939/32.png) [@Philippe\_Bossu](https://community.gatling.io/u/Philippe_Bossu)\ **Post date:** [April 30, 2013, 6:38am UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/5 "2013-04-30T06:38:16Z")
For completeness: - [http://jmeter.apache.org/usermanual/component\_reference.html#Keystore\_Configuration](http://jmeter.apache.org/usermanual/component_reference.html#Keystore_Configuration) - [http://stackoverflow.com/questions/14607897/jmeter-and-optional-ssl-client-certificate](http://stackoverflow.com/questions/14607897/jmeter-and-optional-ssl-client-certificate) - [http://jmeter.512774.n5.nabble.com/Certificate-Based-Authentication-td5713372.html](http://jmeter.512774.n5.nabble.com/Certificate-Based-Authentication-td5713372.html) Regards ---
**Author:** ![Nicolas\_R](https://avatars.discourse-cdn.com/v4/letter/n/f14d63/32.png) [@Nicolas\_R](https://community.gatling.io/u/Nicolas_R)\ **Post date:** [April 30, 2013, 7:20am UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/6 "2013-04-30T07:20:10Z")
How does this work then ? You specify the Keystore, and from that, JMeter cycle thru all the certificates ? What if you inject more users than the number of certificates your have ? Regards ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [April 30, 2013, 7:30am UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/7 "2013-04-30T07:30:45Z")
Let me talk about this with Jean-François (the AHC project leader) to see if we can find a proper solution for this. Cheers, Stéphane ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [April 30, 2013, 2:19pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/8 "2013-04-30T14:19:21Z")
@JB: I was able to have one AHC instance per user, while sharing the underlying thread pools. Meaning that we could perfectly implement what you need. I would just need some help on the SSL part: [https://github.com/excilys/gatling/blob/master/gatling-http/src/main/scala/io/gatling/http/ahc/GatlingHttpClient.scala#L63](https://github.com/excilys/gatling/blob/master/gatling-http/src/main/scala/io/gatling/http/ahc/GatlingHttpClient.scala#L63) Cheers, Stéphane ---
**Author:** ![Jean-Baptiste\_Reich](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@Jean-Baptiste\_Reich](https://community.gatling.io/u/Jean-Baptiste_Reich)\ **Post date:** [April 30, 2013, 3:27pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/9 "2013-04-30T15:27:45Z")
Hi, The problem as I understand it is that the keystore is only defined once in gatling.conf. Then, the same instance is given to all AHC. The solution would be to provide a keystore for each AHC but I don’t know how… Jean-Baptiste ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [April 30, 2013, 3:38pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/10 "2013-04-30T15:38:24Z")
No no no, this part will be just fine. 🙂 I just need to get sure that passing one keystore per user is fine for you, or if you want one single keystore containing multiple key. I have no problem with the first solution, but I don’t know how to implement the second one. ---
**Author:** ![Jean-Baptiste\_Reich](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@Jean-Baptiste\_Reich](https://community.gatling.io/u/Jean-Baptiste_Reich)\ **Post date:** [April 30, 2013, 3:40pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/11 "2013-04-30T15:40:28Z")
OK, One KeyStore per user is fine for me. Thanks ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [April 30, 2013, 3:43pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/12 "2013-04-30T15:43:31Z")
Cool! Can you wait a day or two so I implement this properly? ---
**Author:** ![Jean-Baptiste\_Reich](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@Jean-Baptiste\_Reich](https://community.gatling.io/u/Jean-Baptiste_Reich)\ **Post date:** [April 30, 2013, 3:47pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/13 "2013-04-30T15:47:01Z")
Yes ! Thank you for your reactivity ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [April 30, 2013, 3:48pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/14 "2013-04-30T15:48:54Z")
Stay tuned! Beware that you’ll have to walk on the wild side: 2.0.0-SNAPSHOT ---
**Author:** ![Philippe\_Bossu](https://avatars.discourse-cdn.com/v4/letter/p/b2d939/32.png) [@Philippe\_Bossu](https://community.gatling.io/u/Philippe_Bossu)\ **Post date:** [April 30, 2013, 6:54pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/15 "2013-04-30T18:54:04Z")
I don't know if it's the proper place for that , maybe jmeter user mailing list or stackoverflow (with jmeter tag) is more appropriate but yes you need to have as many certs as users you inject, otherwise your test would not be realistic anyway and you might introduce non existent problems. Regards ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [May 2, 2013, 11:45am UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/16 "2013-05-02T11:45:36Z")
@JB I have great news: I was able to implement it. Please use this bundle: [https://docs.google.com/file/d/0B1zTVlhQrNiyN2dRcExteWVoUGM/edit](https://docs.google.com/file/d/0B1zTVlhQrNiyN2dRcExteWVoUGM/edit) Here’s the procedure: [https://github.com/excilys/gatling/issues/1121](https://github.com/excilys/gatling/issues/1121) Beware that we’re dropping our own JsonPath for Jayway’s one, and the syntax is a bit different: [http://goessner.net/articles/JsonPath](http://goessner.net/articles/JsonPath) Please provide feedback. Cheers, Stéphane ---
**Author:** ![Jean-Baptiste\_Reich](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@Jean-Baptiste\_Reich](https://community.gatling.io/u/Jean-Baptiste_Reich)\ **Post date:** [May 2, 2013, 2:42pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/17 "2013-05-02T14:42:18Z")
Hi, Sorry it took time to test because my simulation was based on gatling 2. With the new code I am not able to connect to my application with client certificate. I noticed with basic tests that only my trustStore was used in the test Then, I looked at the code in git and I think I found a bug in gatling-http/src/main/scala/com/excilys/ebi/gatling/http/ahc/GatlingHttpClient.scala: val trustManagers = for { storeType ← session.getAttributeAsOptionString file ← session.getAttributeAsOptionString password ← session.getAttributeAsOptionString algorithm = session.getAttributeAsOptionString } yield newTrustManagers(storeType, file, password, algorithm) val keyManagers = for { storeType ← session.getAttributeAsOptionString file ← session.getAttributeAsOptionString password ← session.getAttributeAsOptionString algorithm = session.getAttributeAsOptionString } yield newKeyManagers(storeType, file, password, algorithm) but I think it should be: val trustManagers = for { storeType ← session.getAttributeAsOptionString file ← session.getAttributeAsOptionString password ← session.getAttributeAsOptionString algorithm = session.getAttributeAsOptionString } yield newTrustManagers(storeType, file, password, algorithm) val keyManagers = for { storeType ← session.getAttributeAsOptionString file ← session.getAttributeAsOptionString password ← session.getAttributeAsOptionString algorithm = session.getAttributeAsOptionString } yield newKeyManagers(storeType, file, password, algorithm) I don’t know how to recompile everything and to test my patch. Can you tell me if you think this will fix my issue and provide me a new gatling environment ? Thanks ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [May 2, 2013, 2:47pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/18 "2013-05-02T14:47:30Z")
Damn copy/paste. Do you prefer a SNAPSHOT of 1.5 or 2.0? ---
**Author:** ![Jean-Baptiste\_Reich](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@Jean-Baptiste\_Reich](https://community.gatling.io/u/Jean-Baptiste_Reich)\ **Post date:** [May 2, 2013, 2:51pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/19 "2013-05-02T14:51:39Z")
2.0 if possible Thanks ---
**Author:** ![Excilys](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@Excilys](https://community.gatling.io/u/Excilys)\ **Post date:** [May 2, 2013, 3:04pm UTC](https://community.gatling.io/t/https-client-certificate-configuration/348/20 "2013-05-02T15:04:51Z")
Here you are: [https://docs.google.com/file/d/0B1zTVlhQrNiyUFhBZzBacGVNZnc/edit](https://docs.google.com/file/d/0B1zTVlhQrNiyUFhBZzBacGVNZnc/edit) [Next page](https://community.gatling.io/t/https-client-certificate-configuration/348.md?page=2)