Running Test with mTLS and API Key

[vuonga000]

Hello,

I'm trying out Artillery for the first time and I managed to get Artillery to work on an unsecured API. However, I want to test the performance of a secured one. The secured API has mTLS (.key and .pem files) and an API key.

I am able to perform a curl command with this setup and I get a response, so it's not the API that is the problem.

Could someone point out what I have wrong with my code, please?

config:
  target: "https://some-url/resource?"
  phases:

    # TESTING
    - duration: 10
      arrivalRate: 5
      rampTo: 50

  defaults:
    headers:
      x-api-key:"some-api-key"

  tls:
    # Can useful for testing, should not be used in production:
    rejectUnauthorized: false
    # Specify client key and certificate:
    client:
      key: "C:/Artillery/z/my_client.key"
      cert: "C:/Artillery/z/my_client.pem"
      passphrase: ""

  payload:
    path: "search_artillery.csv"
    fields:
      - "query_parameters"

scenarios:
  - name: "RPS API Testing"
    flow:
      - get:
          url: "https://some-url/resource?{{ query_parameters }}"

After running the code, I get the following failed output:

PS C:\Artillery> artillery run _02_hard.yml
Phase started: unnamed (index: 0, duration: 10s) 17:21:06(-0500)

Phase completed: unnamed (index: 0, duration: 10s) 17:21:17(-0500)

--------------------------------------
Metrics for period to: 17:21:10(-0500) (width: 2.79s)
--------------------------------------

vusers.created_by_name.RPS API Testing: ..................... 26
vusers.created.total: ....................................... 26
vusers.failed: .............................................. 26
http.request_rate: .......................................... 12/sec
http.requests: .............................................. 26
errors.ECONNRESET: .......................................... 26


--------------------------------------
Metrics for period to: 17:21:20(-0500) (width: 8.226s)
--------------------------------------

vusers.created_by_name.RPS API Testing: ..................... 210
vusers.created.total: ....................................... 210
vusers.failed: .............................................. 210
http.request_rate: .......................................... 28/sec
http.requests: .............................................. 210
errors.ECONNRESET: .......................................... 210


All VUs finished. Total time: 13 seconds

--------------------------------
Summary report @ 17:21:19(-0500)
--------------------------------

vusers.created_by_name.RPS API Testing: ..................... 236
vusers.created.total: ....................................... 236
vusers.failed: .............................................. 236
http.request_rate: .......................................... 22/sec
http.requests: .............................................. 236
errors.ECONNRESET: .......................................... 236

Any help would be greatly appreciated.

Thanks,
Andrew

[hassy]

hi @vuonga000 👋 Artillery expects the contents of key, and cert keys to be the actual data, rather than file paths. If you replace the values with the contents of those file, the test should work.

[elarrat]

Is that still valid? The example on the docs shows the following:

client:
      key: "./client-key.pem"
      cert: "./client-crt.pem"

And if what you're saying is still true, the documentation is a little misleading.

[hassy]

hi @elarrat 👋 The example in the docs (this one: https://www.artillery.io/docs/guides/plugins/plugin-ssl-client-certificate-auth#basic-configuration) is for Artillery Pro, which has a plugin that reads files automatically.

If you're not using Artillery Pro, then the contents of those files needs to be provided.

[vuonga000]

Hi @hassy 👋 Thanks for the reply!

I tried replacing with the key and cert values and got the same failures. :( There's no error message, though, is this a feature I need to turn on?

Is there anything else I should try that you can suggest?

Thanks,
Andrew

PS C:\Artillery> artillery run _02_hard.yml
Phase started: unnamed (index: 0, duration: 10s) 09:29:23(-0500)

Phase completed: unnamed (index: 0, duration: 10s) 09:29:34(-0500)

--------------------------------------
Metrics for period to: 09:29:30(-0500) (width: 6.044s)
--------------------------------------

vusers.created_by_name.RPS API Testing: ..................... 93    
vusers.created.total: ....................................... 93    
vusers.failed: .............................................. 89    
http.request_rate: .......................................... 18/sec
http.requests: .............................................. 93    
errors.ECONNRESET: .......................................... 89    


--------------------------------------
Metrics for period to: 09:29:40(-0500) (width: 4.133s)
--------------------------------------

vusers.failed: .............................................. 135   
vusers.created_by_name.RPS API Testing: ..................... 131   
vusers.created.total: ....................................... 131   
http.request_rate: .......................................... 34/sec
http.requests: .............................................. 131   
errors.ECONNRESET: .......................................... 135   


All VUs finished. Total time: 13 seconds

--------------------------------
Summary report @ 09:29:35(-0500)
--------------------------------

vusers.created_by_name.RPS API Testing: ..................... 224   
vusers.created.total: ....................................... 224   
vusers.failed: .............................................. 224   
http.request_rate: .......................................... 28/sec
http.requests: .............................................. 224   
errors.ECONNRESET: .......................................... 224

[hassy]

Could you double-check that the values you're pasting into the script are copied exactly as-is, ie. withoun extra newline characters, and without your editor converting any whitespace characters on save?

Another way of loading those values is through environment variables. On Linux/macOS it would look like this:

export TLS_KEY="$(cat my_client.key)" # make the file contents available in TLS_KEY env var

I don't have Windows handy, but it should have a similar mechanism.

and then in your Artillery script:

tls:
  client:
    key: "{{ $processEnvironment.TLS_KEY }}" # use the environment variable we set

and then run artillery as normal.

[vuonga000]

Hey @hassy , thanks again for the quick reply!

So the contents of the files is a block of alphanumeric characters (guessing it's encrypted), passing that exactly doesn't seem to work.

I also tried testing after removing all newlines so it's one long string and that didn't work either. I did this in a Notepad.

[bluezombie]

Hi @vuonga000

Just wanted to know if you finally made it with the suggestion of @hassy.

Thanks.

[kenovergard]

So in case anyone in the future goes looking for how to setup mTLS for Artillery, the above is no longer the way to do it.

By painstakingly debugging into Artillery's request ssl negotiation, into the Got library's _makeRequest() function, I see that it's actually looking for configuration keys named certificateAuthority and certificate rather than ca and cert. as documented here. These need to be set to the PEM contents, so an Artillery config like THIS will work against mTLS endpoints:

 config:
  target: "{{ $processEnvironment.LOAD_TEST_URL }}"
  tls:
    rejectUnauthorized: true
    enableTrace: true
    secureProtocol: "TLSv1_3_method"
    certificate: "{{ $processEnvironment.cert }}"
    certificateAuthority: "{{ $processEnvironment.root }}"
    key: "{{ $processEnvironment.key }}"
    ...

@hassy the docs around this could use an update, they're quite misleading.

[zargor]

Cannot make it work with websockets. Always getting this error:

errors.ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED: