Artillery: TLS certificate verification doesn't always work as expected

[hassy]

Artillery does not always recognize valid TLS certificates. For example:

$ artillery quick -d 10 -r 5 https://artillery.io

  Scenarios launched: 49
  Scenarios completed: 0
  Number of requests made: 0
  RPS: 4.73
  Request latency:
    min: Infinity
    max: -Infinity
    median: NaN
    p95: NaN
    p99: NaN
  Scenario duration:
    min: Infinity
    max: -Infinity
    median: NaN
    p95: NaN
    p99: NaN
  Errors:
    UNABLE_TO_VERIFY_LEAF_SIGNATURE: 49

The issue is that Node.js uses its own certificate bundle, which does not include many CAs. To fix, a custom bundle needs to be used by the HTTP engine.

[vineyugave]

@hassy How do we point to the custom HTTP engine ?

[hassy]

Not sure what you mean @vineyugave. If you want to use a custom engine, you need to set the engine field of your script to the $name of the engine, and have artillery-engine-$name available to require.

[vineyugave]

@hassy I just wanted to know how you overcame this issue where it gives "UNABLE_TO_VERIFY_LEAF_SIGNATURE: 49" error...

[hassy]

@vineyugave you can use -k flag to turn off certificate validation, like so: artillery run -k myscript.json

[vineyugave]

@hassy thanks a ton.. that saved my day ...

[alex7kir]

Hi, I have a problem with this option. I've tried using every variant of turning certificate validation off described here, but UNABLE_TO_VERIFY_LEAF_SIGNATURE error still appears. What could the problem be?

[hassy]

@alex7kir Odd! Is it a self-signed certificate? Are you testing HTTP or
WS/Socket.io?

On Wednesday, 3 August 2016, alex7kir [email protected] wrote:

Hi, I have a problem with this option. I've tried using every variant of
turning certificate validation off described here
https://artillery.io/docs/testing_http.html#ssl, but
UNABLE_TO_VERIFY_LEAF_SIGNATURE error still appears. What could the problem
be?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/shoreditch-ops/artillery/issues/59#issuecomment-237155919,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAAF0t8Y6Pvt9EoheUq-Cz5rDipXnf_Nks5qcDiogaJpZM4Hgv6n
.

[alex7kir]

@hassy Yes, it is a self-signed certificate. I'm testing WS.

[hassy]

@alex7kir thanks, that's a bug - will ship a fix soon

issue: https://github.com/shoreditch-ops/artillery/issues/150

[zavermax]

I am using a not self signed certificate and I am still getting this error message:
UNABLE_TO_VERIFY_LEAF_SIGNATURE: 502
or sometimes
UNABLE_TO_VERIFY_LEAF_SIGNATURE: 500
Using -k flag to ignore certificate validation works though.

[hassy]

@zavermax yes that's a known problem (described in the issue) caused by Node.js having its own CA store. Which CA issued the cert that isn't being recognized?

[zavermax]

Comodo

[hassy]

Closing this for now as more recent versions of Node seem to include more CAs.