PKCS11 keystores cannot be used to conduct TLS due to the assumption that keystores will always be file based. I intend to submit a PR, which will take some time, unless a patch as produced by "git diff" is acceptable (I don't use eclipse).
git diff is fine.
Created attachment 36221 [details] jmeter pkcs11 patch The attached patch successfully passes tests with the exception of some tests that were failing before the patch was applied in my environment (unable to resolve jmeter.org etc.). Patch also passes checkstyle as required in submission guidelines. What the patch does: - Removes the assumption of a file based keystore - Adds password masking for the SSLManager password prompt. I included this because it is likely that if the use of a PKCS11 crypto module is required to load test/test, a plain text password prompt is likely to be unacceptable. The use of PKCS11 requires configuring the JVM running jmeter as described in https://docs.oracle.com/javase/8/docs/technotes/guides/security/p11guide.html The patch was tested against a PKCS11 configured JVM on Red Hat Enterprise Linux 7 using the libcoolkey pkcs11 smart card driver in conjunction with a smart card. Note that the PKCS11 module password/pin must be configured via JSSE system properties if running in non-gui mode. It should be possible to implement a command line prompt when running outside of the GUI mode, but I haven't had time to explore this yet.
Thanks for the patch and sorry for the long delay. A variant on your patch has been submitted to trunk. It would be awesome, if you could test it and close the bug, if it works. Will be included in 5.2 (if nothing speaks against it). Date: Sun Mar 24 13:13:40 2019 New Revision: 1856146 URL: http://svn.apache.org/viewvc?rev=1856146&view=rev Log: Enable PKCS11 keystores for usage with KeyStore Manager Based on a patch by Clifford Harms (clifford.harms at gmail.com). Bugzilla Id: 62863 Modified: jmeter/trunk/src/core/org/apache/jmeter/util/SSLManager.java jmeter/trunk/src/core/org/apache/jmeter/util/keystore/JmeterKeyStore.java jmeter/trunk/xdocs/changes.xml jmeter/trunk/xdocs/usermanual/component_reference.xml
Did some testing on linux configured with pscsd and a cardreader with a hardware token, the patch appears to work fine. There is no prompt to select a specific cert if multiple certificate aliases are in a PKCS11 store (first cert encountered is used?), but this is does not hamper my use case.
Thanks for confirming, that it passes your tests.
This issue has been migrated to GitHub: https://github.com/apache/jmeter/issues/4906