while recording Mobile Application. Trafic is not going via Proxy.
I have installed CA certificate in Android App.
Jmeter is recording but recording only Certain URLs and Other URLS like Google, Appstore are not been recorded including my Mobile APP (App under test,SUT).
I am unable to Login in to the APP aswell when i set Proxy in mobile App (under Manual)
Jmeter : V.5.1
Android : 9
JDK: 13
Mobile Application has Microsoft Login credentials.
Response I get is SSL handshake : certificate_Unknown and I get :443 Error Response.
can any one Help me with this issue .
Starting from Android 7.0 (Nougat) you need to perform some specific network security configuration in order to use self-signed MITM certificates (inluding JMeter's one)
Under application section of your application manifest add the next line:
android:networkSecurityConfig="#xml/network_security_config"
Under res folder create the network_security_config.xml file and put the following code there:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<debug-overrides>
<trust-anchors>
<!-- Trust user added CAs while debuggable only -->
<certificates src="user"/>
</trust-anchors>
</debug-overrides>
</network-security-config>
Build your application in debug mode
gradlew assembleDebug
That's it, now you should be able to capture your application secure traffic with JMeter's HTTP(S) Test Script Recorder. Check out Recording Using Android Devices article for more details if needed
Other options are:
If your application can be built for Android < 7.0 you can use the device or emulator - it will be quite enough to just install ApacheJMeterTemporaryRootCA.crt file there
If you have rooted device or emulator - you can add the JMeter's certificate into Android trusted CA
Related
I have tried recording native iOS app ( developed in Swift and Objective C++ ) in Jmeter using proxy but it didn't worked .
I also tried recording native app ( removing SSL from app ) but it didn't worked either.
For recording HTTPS traffic you need to install JMeter's self-signed certificate onto your mobile device. The file is called ApacheJMeterTemporaryRootCA.crt and you need to pass it somehow to your iOS device (send by email, upload to a web server and open it in your browser, etc.)
The file is being generated under "bin" folder of your JMeter installation when you start HTTP(S) Test Script Recorder
Additionally you will need to switch on "ENABLE FULL TRUST FOR ROOT CERTIFICATES", the setting lives under Settings -> General -> About -> Certificate Trust Settings
Be informed that the certificate has limited life span (7 days by default) so if you imported it a while ago you will need to reinstall the "fresh" version.
Also make sure to turn off the cellular data and configure Wi-Fi adapter to use JMeter as the proxy, given you start the proxy and properly configure your device to use it you should be able to capture HTTP traffic without any extra setup and HTTPS traffic if you have the JMeter's certificate installed.
All the traffic which is not HTTP or HTTPS will not be captured/recorded
More information: Load Testing Mobile Apps Made Easy
Can we create script of a native mobile application (Android here, not a Hybrid application or Mobile Browser based application).
I did all sorts of configurations required in Mobile- like setting proxy matching to the IP4 of the machine JMeter is run on. When i start recording I see listener of HTTP(S) Test Script Recorder showing errors:
Response message:Received fatal alert: certificate_unknown
ensure browser is set to accept the JMeter proxy certificate
and Response as:
javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
Kindly hep to get an understanding of the concept and how to fix it.
Thanks,
PS
First of all make sure to import the JMeter's MITM certificate to your Android device. The certificate file is called ApacheJMeterTemporaryRootCA.crt and it's being generated in "bin" folder of your JMeter installation when you start the HTTP(S) Test Script Recorder.
See HTTPS recording and certificates chapter of the HTTP(S) Test Script Recorder documentation for more information
If you're running Android 7.0 or higher you will need to take some extra steps in order to be able to capture native application traffic, in particular:
Add the next line to the application section of your Android app manifest file:
android:networkSecurityConfig="#xml/network_security_config"
Create network_security_config.xml file under your app resources folder and put the following code inside:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<debug-overrides>
<trust-anchors>
<!-- Trust user added CAs while debuggable only -->
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>
Compile and install your application in debug mode like:
gradlew installDebug
Once you follow the above steps and launch the debug version of the application with lowered network security you should be able to intercept and decrypt its traffic using JMeter's proxy server.
More information: Recording Using Android Devices
I am trying to record the native app performance testing by using jmeter HTTP(S) Test Script Recorder and after installing ApacheJMeterRootCA certificate in mobile device and also configuring Proxy settings, I am getting certificate_unknown error whenever I open the app and try to use it
Note : JDK8 and JMeter 4.0 is used
Assuming correct JMeter configuration (i.e. you have imported JMeter's self-signed certificate onto device and the device proxy configuration matches HTTP(S) Test Script Recorder settings) you should be able to record your application traffic normally.
Unless you're using latest Android versions (Nougat 7 or higher) where you need to amend your application source code in order to configure the application to trust user certificates.
Add the next line to your application manifest (under application tag)
android:networkSecurityConfig="#xml/network_security_config"
Add network_security_config.xml file under res folder of your application and put the following code into it:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<debug-overrides>
<trust-anchors>
<!-- Trust user added CAs while debuggable only -->
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>
Rebuild your application and run it in debug mode - now JMeter should be able to capture the requests.
More information:
Bypassing Android’s Network Security Configuration
Recording Using Android Devices
In Jmeter, I am facing issues with SSL identification when tried to record the traffic on my mobile application. Error message I am getting is Problem with SSL certificate for url for XXXXXXXX Ensure browser is set to accept the JMeter proxy cert: Received fatal alert: certificate_unknown
I have already tried Installing dummy Jmeter certificate in mobile, by referring this link. But it didnt work.
Some information about my apps
1) My application is on http layer, but during login process its referring some third party apis which are on https layer
2) Jmeter is getting stuck at the page where we are referring facebook, twitter and some other third party plugins. And the error page in Jmeter displaying certificate unknown against each of those plugins.
Experts, please throw some light.
I know this is posted almost 2 years ago but for those who are seeing this thread, I want to share what helps me solve the same issue --> Need to modify the APK to include network_security_config.xml using tools available if you have JDK (Search APKTool and KeyTool in your file explorer)
Transfer the APK from your phone to your PC (you can use the android app to locate the APK)
Decompile the APK (APKTool)
Manually Sign the APK (KeyTool)
Compile the APK (APKTool)
Transfer APK to your phone
Install APK on your phone
Follow the steps in Jmeter recording
More info here for editing network_security_config.xml
https://www.ubik-ingenierie.com/blog/how-to-record-android-application-using-https-traffic-jmeter/
More info here for decompiling, signing, recompiling
http://www.decompileandroid.com/
How to Sign an Already Compiled Apk
J-meter version 2.12 and 2.13
OS windows : Windows 7
Android version 4.4
NOTE:Mobile app is our test environment and still under testing phase
J meter recording:
When I set the proxy then the app is not recording in j meter i.e. Am not able
to login to the app itself.
However if I remove the proxy setting then am able to login to app successfully
and can perform the transactions
I tried with the app which are their in play store , most of the app are
recorded with proxy setting
So am a having doubt due to signed apk then the app is recording in j meter are what ?
Am not able to figure whats the problem is . Can anybody please help me.
Our Plan is to record the mobile transactions through j-meter and upload the script to Blaze meter
Thanks,
Prabhakar.Y
Your app may be using HTTPS and Android native network configuration utility may not support HTTPS proxying so the options are:
Perform additional configuration:
Use third-party application like ProxyDroid which supports HTTPS proxying
Install JMeter's ApacheJMeterTemporaryRootCA.crt (it's generated in /bin folder of JMeter installation) onto device
Use Mobile Recorder service instead.