3

All, I have an HP VuGen client that is using 2 TCP/IP connections to do the TLS v1.2 handshake with my server when mutual authentication is enabled.

According to Wireshark, the sequence is approximately this:

  1. Client SYN
  2. TLS v1.2 client hello
  3. Server sends server hello, certificate, server key exchange, certificate request, server hello done
  4. Client FIN's the old connection
  5. Client SYN's a new connection
  6. Server handshake failure on the old connection (out of order packet)
  7. TLS v1.2 client hello
  8. Server hello, certificate, server key exchange, certificate request, server hello done
  9. (everything is ok after this)

Neither Openssl nor a standalone java client exhibits this same behavior. When the server asks for the client certificate the first time, they send it.

With VuGen, I can't see anything different about the two client hello message, nor the server responses. There are definitely two connections, though, because there are 2 FIN's from the client using 2 different outbound ports.

Why would the client do this?

FWIW, it doesn't matter whether I go through a load balancer or not. I get the same behavior.

I believe this has something to do with the server asking for the client certificate because the same server has another non-MA port open that is otherwise configured the same and the VuGen client only makes a single connection there.

Thanks

3

As far as I understand the aim of LoadRunner (i.e. the software which VuGen is part of) is to simulate a real client like a browser. If a browser connects first to a web site which requires a client certificate then the browser has to interact with the user to find out which certificate should be used and to get the password for the private key. In this case the browser will not stall the handshake, but close the connection, ask the user and then reestablish a new connection. My guess is that LoadRunner tries to simulate exactly this behavior.

  • That's an interesting idea. I tried emulating various browsers but they didn't matter. I also switched my vugen method from web_custom_request to soap_request, since these are really soap calls, but that didn't make any difference, either. Thanks. – John Gregg Feb 2 '16 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.