Record JMeter script for Mobile App making HTTPS calls - ssl

I am trying to do performance test using JMeter for a mobile application. My application is secured and makes HTTPS calls. I came across below guide to install a certificate on client side. Can anyone tell me how can I get this certificate?
Do I have to buy SSL Certificate and install it on my computer and my android device?
Can some one help me to make me understand below guide in plain English? I am successfully able to record and playback when our mobile APP is not Secured i.e. able to make HTTP calls without any troubles. Thanks and any help is appreciated. Also, I am okay to pay for a Training on JMeter who can teach me how to do this. Thanks.
https://www.blazemeter.com/blog/how-set-your-jmeter-load-test-use-client-side-certificates/

In order to be able to record the mobile device traffic you need to install JMeter's MITM certificate which will allow JMeter to intercept and decrypt secure requests.
You don't need to buy anything, the certificate is being generated in "bin" folder of your JMeter installation when you start HTTP(S) Test Script Recorder, the file is called ApacheJMeterTemporaryRootCA.crt and this is the certificate you need to install onto your mobile device/emulator in order to be able to record HTTPS traffic.
The instructions differ depending on mobile OS and even OS version, the most painful is capturing traffic on Android >= 7.0, the exact steps can be found in Bypassing Android’s Network Security Configuration and Recording Using Android Devices guides

Related

SSL from personal machine for testing Progressive Web Apps

I want to test building Progressive Web Apps and know this requires SSL. I am able to test onlocalhost (using npm http_server) but would like to test from other machines on the same local network and some mobile devices, so I need https and an SSL certificate.
I have tried using XAMPP on a windows machine, and made a certificate using makecert, but even though I installed it on Chrome on another machine, it didn't work.
Any ideas how I can achieve this ie run web server of some kind on one Windows 10 machine, host the pages using SSL and browse from another and mobile devices?
Do I have to use 3rd party certs, and would these work on a local machine (eg by local IP) rather than a domain name?
Bit confused!

Mobile app testing with jmeter, internet connecrion does not work after conguiring proxy settings

I am doing a mobile test recording with jmeter, after i configure my mobile proxy settings to system ip and port to math jmeter. Internet stops working? P.S. i already installed the ApacheJmeterTemporaryRootCA.crt
There is a number of "mobile" operating systems and we are not telepathic enough to figure out which one you're talking about in order to provide troubleshooting instructions. I assume you use Android as it is about 75% of market.
Make sure to start JMeter's HTTP(S) Test Script Recorder prior to amending mobile device proxy settings
Make sure JMeter and mobile device are on the same subnet (connected to the same WiFi network)
Make sure that port 8888 is open in your operating system firewall
On certain Android versions you cannot set system proxy for HTTPS traffic, you will need to install a separate application like ProxyDroid for this
If nothing helps you can always consider an alternative way of recording mobile traffic, in this case you won't have to worry about proxies and certificates and you will get confidence that your device is connected to the Internet. See Testing Mobile sites and Apps article for more details.
I am very late here, but still this may help others who are still facing this issue.
In beginning i faced the same issue. Then, I tried by disabling the firewall. It worked fine.
Also disabling firewall may create a way for malicious contents to enter. Try only for trusted sources.

Issues encountered on a fresh installation of RocketChat (1524) on Ubuntu

I have just downloaded and installed latest Rocket.chat using SNAP tool on Ubuntu (16.04 LTS). Overall, I had a smooth experience of installing and getting started with Rocket.chat. However, I did find a few serious issues.
I try to get auto SSL running by following the instructions at: https://rocket.chat/docs/installation/manual-installation/ubuntu/snaps/autossl/. But after configuring the Caddy file, the Caddy service failed to start, with the message:
Activating privacy features… 2018/04/24 17:58:09 open /root/snap/rocketchat-server/1254/.caddy/acme/acme-v02.api.letsencrypt.org/sites//.crt: no such file or directory
The second issue is with start video chat using webRTC. When I clicked on it, nothing happened. I am using Chrome browser and tried to start video chat on several devices. All the Chrome browsers have passed the webRTC tests. I don’t know why video screen is not shown.
I signed in with open.rocket.chat and compared the differences between my installation and the official site. When my browser points to open.rocket.chat site, the videochat does not work either. It does show the video window, but only displays only myself, not the remote member. Note to experiment, I signed up with 2 accounts to simulate 2 members chatting.
Also I downloaded the Android Rocketchat client. However, I couldn’t find the start video chat option. Is it true that video chat is unavailable yet on the Android client?
To summarise, we have the issue of setting up auto SSL with Caddy, and using video chat (webRTC). It could be that I missed a few basic configurations on my environment. Other functions like text messaging works fine.
We are deciding whether we should use Slack/CometChat for our instant messaging solution. It seems RocketChat has all the features we want, but it is a pity we couldn’t get it to work completely.
Appreciate someone can guide me in this.
I did some investigations on these issues, and have made some progress. I'd like to share my findings, which I hope could be of some help in future to newbies of RocketChat like me.
However, I still have a few issues unresolved, and hope someone could help.
Caddy service failed to start
Using self-signed certificate and defining the domain name in /etc/hosts, I can get Caddy service to start and https to work. My guess is that the domain name I used, even it is registered with a DNS provider, has no CNAME record, and is not mapped to any IP address. Letsencrypt, which is used by Caddy to do on-demand SSL, therefore is unable to create a SSL certificate for my domain name. It would be nice if the RocketChat documentation could make it clearer.
open.rocket.chat WebRTC-based video chat not working
after I used another Windows machine, the video chat is working. Presumably my previous computer does not have the latest Windows update. But I am glad with open.rocket.chat site, every feature I tested is working.
On my self-hosted Rocket-chat (i.e. a Linux server at home), however, the video chat is still not working. When I clicked on the "start video chat" button, no video screen is launched on my browser window. On the remote browser (which was used for simulating the conversation partner), there is a notification "xxx invites you to video chat, do you accept?". I clicked on "Yes". After that, nothing happens on the remote browser. The only issue I can think of is that I didn't use https to connect to the self-hosted Rocket-chat. Because I am using several computers in my home wireless network. I only use http://192.168.0.3:3000 to point to the chat server. I am wondering if secure connection is required in order to use video chat?
On the Android Rocket Chat app, I couldn't find any links to start a video chat, nor can I receive any video chat invite. Is it by design or a defect?
Hope someone can enlighten me on these issues.
I made further investigation as to why webRTC does not work on my self-hosted Rocket-chat instance. It is related to secured connection. There is a related discussion in the RocketChat forum:
https://github.com/RocketChat/Rocket.Chat/issues/1813
Basically, the connection to the Rocket.chat server must be secure for WebRtc to work. After I configure Caddy to support HTTPS listening on Rocket.Chat (currently using self-signed certificate), WebRTC works. It would really help users if the documentation can make this clear.
Now the remaining issue for me is to figure out if Android Rocket Chat app supports Web RTC.

Jmeter Facebook Issue

I am testing the mobile application with a HTTP(s) script recorder(mobile is connected to JMeter via computer IP address.).
From an app, if I try to login with facebook then it shows failure report in jmter,b ut if I hit the stop button from JMeter(https script recorder) and then after if I try to login with facebook then I can easily able login with facebook.
In order to be able to record HTTPS calls you need to install JMeter's self-signed certificate onto your device.
Start JMeter's HTTP(S) Test Script Recorder
Locate ApacheJMeterTemporaryRootCA.crt file under "bin" folder of your JMeter installation and transfer it somehow to your device (i.e. send it to yourself by email)
Open the certificate on your mobile device and follow your operating system certificate installation dialog to set this up
Now you should be able to record HTTPS traffic. Note that certain mobile operating systems don't support HTTPS proxy on Wi-Fi connection settings level so you may have to use a 3rd-party application for this (i.e. ProxyDroid for Android)
You can also try out a cloud-based proxy service for recording JMeter tests which automates certificate installation process and is capable of exporting the recorded script in "SmartJMX" mode with automatic correlation applied.

Remotely hosted HTTPS Images not displaying in Safari 4.1.3 on Macs

Working with a ticketing system site that must be accessed via HTTPS at https://www.threestages.net
Our images are hosted elsewhere ( https://wserver.flc.losrios.edu/~vapa/) and also accessed via HTTPS.
We have multiple reports that Safari 4.1.3 on Macs is not displaying the images. We have no reports of this behavior from any other browser or platform.
Any one have any notion what that would be about?
Thanks for any thoughts,
JG
So it turns out that Safari has an issue with the SSL Cert at https://wserver.flc.losrios.edu/
http://www.sslshopper.com/ssl-checker.html let me know that
The certificate is not trusted in all
web browsers. You may need to install
an Intermediate/chain certificate to
link it to a trusted root certificate.
Thanks for looking at this. Valuable lessons learned:
Even if 4 out of 5 browsers accept an SSL Cert that doesn't mean they all do
Just because the sysadmin says it's not his problem/mistake doesn't make it so!
Check everything. Then repeat.