Created attachment 32743 [details] JMX to reproduce the issue I was undergoing tests on our AWS platform and JMeter was failing to query HTTPS CloudFront urls. The following exception happens when executing an HTTP Sampler with HC4 implementation: > javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure > at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) > at sun.security.ssl.Alerts.getSSLException(Alerts.java:154) > at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:2011) > at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1113) > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1363) ... After investigating more about this issue, i found out the bug is related to the Server Name Extension. HTTPClient 4.2.x sends the following handshake: > Thread Group 1-1, WRITE: TLSv1.2 Handshake, length = 207 > Thread Group 1-1, READ: TLSv1.2 Alert, length = 2 > Thread Group 1-1, RECV TLSv1.2 ALERT: fatal, handshake_failure > Thread Group 1-1, called closeSocket() > Thread Group 1-1, handling exception: javax.net.ssl.SSLHandshakeException: > Received fatal alert: handshake_failure HTTPClient 3.1 which works fine, it sends the following handshake: > Extension server_name, server_name: [type=host_name (0), > value=d1lto7any9tcj3.cloudfront.net] > *** > Thread Group 1-1, WRITE: TLSv1.2 Handshake, length = 245 > Thread Group 1-1, READ: TLSv1.2 Handshake, length = 61 > *** ServerHello, TLSv1.2 The current version of JMeter's HttpClient (4.2.6) has a major SSL issue, it does not support SSL Server Name Extension (SNI): https://issues.apache.org/jira/browse/HTTPCLIENT-1119 As HTTPClient 3.1 will be discontinued and usage is discouraged, we should upgrade HTTPClient to the latest version to benefit bug fixes and improvements.
+1 for this issue. This is also related to #57319. When trying to verify SNI handling behaviours in a proxy it would be better to be able to use supported versions than something that is approaching EOL.
Created attachment 33372 [details] Test plan to reproduce issue
Author: pmouawad Date: Wed Feb 17 10:47:40 2016 UTC (4 minutes, 21 seconds ago) New revision : 1730810 URL : http://svn.apache.org/viewvc?view=revision&revision=1730810 Changed paths: 3 Log Message: Bug 57935 - SSL SNI extension not supported by HttpClient 4.2.6 Bugzilla Id: 57935 Added: jmeter/trunk/src/protocol/http/org/apache/jmeter/protocol/http/sampler/JMeterClientConnectionOperator.java Modified: jmeter/trunk/src/protocol/http/org/apache/jmeter/protocol/http/sampler/MeasuringConnectionManager.java jmeter/trunk/xdocs/changes.xml
Hi reporter, commenters, issue is fixed in nightly build (available tomorrow), your feedback is welcome. Thanks
Hi Philippe, Thanks for the fix, i tested Build #4986 and it works fine. Best regards, Jerome Loisel
This issue has been migrated to GitHub: https://github.com/apache/jmeter/issues/3595