Client Side certificates with LoadRunner

Many applications make use of the SSL extension to the HTTP protocol that adds an encryption layer to the HTTP stack. If performance test tool can't handle SSL then you won't be able to record any transactions.
One way of increasing security is to make use of client certificates, which can be installed into the application

client before access is permitted to an application. The certificates are provided in a number of formats (typically pfx or p12) and must be made available to your performance testing tool for successful capture and replay.
Please follow the steps below to import, export the certificate in the format recommended by LoadRunner.
 
Import Client Certificate in Browser

1. Click Start, click Control Panel, double-click Internet Options, and then click the Content tab

2. Click Certificates.

        a)The Certificates dialog box opens.
3. Click the Personal tab, and then click Import.

        a)The Certificate Import Wizard opens.
        b)On the Welcome page, click Next.

4. On the File to Import page, click Browse, select your certificate (if necessary, select your certificate type in Files of Type drop-down menu), and then click Next.

5. On the Password page, type the certificate’s password, select Mark this key as exportable, and then click Next.

6. On the Certificate Store page, select Place all certificates in the following store, browse to the Personal certificate store (if it’s not already selected), and then click Next.

7. On the Completing the Certificate Import Wizard page, click Finish.

8. Verify that the imported certificate appears in the Personal tab of the Certificates dialog box.

Export a private key

1. Under Internet Options, and then click the Content tab.

2. Click Certificates.

       a)The Certificates dialog box opens.
3. In the Certificates dialog box, click the Personal tab, select the certificate to export, and then click Export.

       a)The Certificate Export Wizard opens.
       b)On the Welcome page, click Next.

4. On the Export Private Key page, select Yes, export the private key, and then click Next.

5. On the Export File Format page, choose Personal Information Exchange – PKCS #12 (.PFX), select Include all certificates in the certification path if possible, clear the other check boxes, and then click Next.

6. On the Password page, type and retype the certificate’s password, and then click Next.

7. On the File to Export page, type the path and name of the file to export, and then click Next.

     a)The wizard will add the .pfx extension automatically.

8. On the Completing the Certificate Export Wizard page, click Finish.


Convert .PFX to .PEM format using OpenSSL

1. Download latest version of OpenSSL from OpenSSl Website

    a. http://www.openssl.org/source/

2. Convert PFX format to PEM format using the command below

a. OPENSSL PKCS12 –in <> -out <>

b. Enter the password given while exporting the certificate

c. Enter any PEM pass phase :e:g 2222

d. Reconfirm the pass phase by typing the same number again.

Open SSL

Note: SSL utility available in LoadRunner 9.5 may crash or may not work as intended. It is better to download the utility from OpenSSL website
 
WebServices Security in LoadRunner

Transport Level Security

Secure Sockets Layer (SSL) is a common transport layer approach that is used to provide encryption to message layer security. If your web service URL begins with https, SSL is automatically used.

•  First copy the created .pem file using OpenSSL utility into LoadRunner Script folder
• Set up the transport level security using the following function in LoadRunner

 web_set_certificate_ex("CertFilePath=testpem1111.pem",

"CertFormat=PEM",
"KeyFilePath=testpem1111.pem",
"KeyFormat=PEM",
"Password=2222", // PEM pass phase
LAST);

Note: if a web service doesn’t uses https URL then this function is not required in VuGen

Legacy Based Security

If in addition to SSL you are using message-level security (for example a username) then you must configure the security for the message separately using the Legacy/Scenario based security model (web_service_set_security) function.

When a SOAP message sends a request, those security credentials, known as security tokens, are placed in the SOAP message. When the Web server receives the SOAP request, it does not need to send additional requests to verify the integrity of the sender. The server verifies that the credentials are authentic before letting the Web Service execute the application. By not having to go back to the source of the credentials, this significantly improves the application’s scalability

VuGen allows you to create security tokens for your script. You can create multiple tokens and set their properties. After creating a token, you use it to sign or encrypt a SOAP message. When you add a security token to a SOAP message, it is added to the SOAP message in the form of an XML element in the WS-Security SOAP header.

a. LoadRunner supports different types of security tokens. The available tokens are

Username and Password, X.509 Certificate,Kerberos Ticket, Kerberos2 Ticket, Security Context Token, andDerived Token.

The information you need to provide differs for each token

b. This following is an example of legacy based security Model using User Name and Password token in LoadRunner

web_service_set_security(
SECURITY_TOKEN, "Type=USERNAME","LogicalName=DP", "UserName=XXXXXX", "Password=XXXXX", "PasswordOptions=SendPlainText", "Add=True",
LAST);

c. X.509 Certificate: When you add an X.509 token to the Vuser script, you specify the Logical Name, Store Name, Key identifier type, Key identifier value, and Store Location arguments.

These inputs to this function can be obtained by downloading Microsoft WSE X509 certificate tool from Microsoft website

web_service_set_security(
SECURITY_TOKEN, "Type=X509", "LogicalName=MyStore", "StoreName=My",
"IDType=SubjectName", "IDValue=C=US, S=CA, L=San Rafael, O=Inc., OU=IT, CN=IT Internal", "StoreLocation=CurrentUser", "Add=True",
MESSAGE_SIGNATURE, "UseToken=MyStore",
LAST);

Scenario based Security Model

LoadRunner also supports Scenario based Security Model for WCF Services which is out of scope of this post