DevOps AcademyLearn the delivery system
Chapter 13Lesson 04~180 minutes

Recording Web Traffic, HTTP(S) Test Script Recorder, and Certificate Setup: Diagnostics, Failure Modes, and Production Practices

Recorder failures can be security incidents as easily as test defects. A working proxy with the wrong trust scope can intercept unrelated credentials; a perfect recording of production can still be unauthorized; a replay full of literal tokens can pass once and then fail under concurrency. Diagnose the trust, proxy, capture, and workload layers separately.

Trust diagnosticsSecret leakageAsset noiseConcurrency misconceptionEvidence preservation

Learning objectives

  • Recognize system-wide recorder CA trust as a security defect.
  • Contain accidental capture of real credentials or unrelated third-party traffic.
  • Reject recording against uncontrolled production/public sites.
  • Find literal tokens/cookies retained in JMX.
  • Diagnose asset replay and captured-concurrency mistakes.
  • Separate recorder/generator symptoms from target performance.

1. Preserve evidence without preserving unnecessary secrets

All reproductions use only localhost:8080/8443 and the disposable profile. Preserve JTL, jmeter.log, recorder settings, filtered request names, certificate fingerprint/trust scope, target events, and cleaned JMX diff. If real secrets/PII were accidentally captured, stop distribution and follow your organization's incident/secret-rotation policy instead of copying the raw secret into more logs.

2. Diagnostic sequence

Recorder/trust/capture diagnostic sequence

Recording sits only in the authoring path. The cleaned JMX is the load-test artifact; the browser proxy and temporary CA are removed before meaningful replay. 

flowchart TD
E[Preserve safe evidence: JMX metadata + JTL + jmeter.log + target events] --> V[Confirm JMeter/Java/keytool/browser versions]
V --> A[Confirm authorized target + recorder port/proxy path]
A --> C[Inspect CA fingerprint + trust scope + expiry]
C --> F[Inspect Include/Exclude + captured host list]
F --> S[Scan headers/params/cookies/tokens/PII]
S --> R[Compare raw vs cleaned JMX + correlation]
R --> W[Confirm Thread Group/timers/workload independent of capture timing]
W --> G[Inspect generator CPU/GC/listener/save-service]
G --> T[Inspect SUT telemetry]
T --> X[Remote/CI/container state if relevant]
X --> M[Least-destructive correction + smallest rerun]

3. Intentionally broken example: recorder CA installed system-wide

Symptom: normal Chrome/Edge or unrelated applications begin trusting JMeter-generated recorder certificates even when you intended only a lab profile. This expands the interception trust boundary beyond the experiment.

Repair: stop recorder, remove the JMeter recorder CA from the OS/system trust store using the platform's certificate-management process, verify normal browser/system trust no longer lists it, then recreate the lab with disposable Firefox profile-local trust. Do not merely wait for the default seven-day validity to expire.

If the CA/private-key material or intercepted secrets may have been exposed, treat it as a security event according to your organization's policy. Deleting one JMX file is not sufficient containment.

4. Failure mode: real credentials or unrelated traffic cross the recorder

Cause: normal browser profile, broad include .*, multiple open tabs/extensions, sync/update activity, or personal login during capture.

Corrective sequence:

  1. Stop recorder immediately.
  2. Close/delete disposable profile or remove proxy/trust.
  3. Do not commit/upload the raw capture.
  4. Rotate/revoke credentials if policy/risk requires it.
  5. Restart with a fresh profile and strict localhost:8443/.* include.

5. Failure mode: recording a production site

“Only recording one click” still intercepts real traffic and may capture credentials/customer data, violate policy, or accidentally replay actions during authoring. This course does not authorize such recording.

Use a local/disposable test environment or construct requests manually from approved API/contracts. Do not weaken authorization requirements because recorder traffic is low volume.

6. Failure mode: captured tokens/cookies remain literal in JMX

A raw POST contains flow_id=FLOW-00001 and csrf=CSRF-00001. It works if the captured session still exists, then fails with 409 under later replay/concurrency.

Repair with extractors under Begin, thread-local variables, and HTTP Cookie Manager. Scan the cleaned JMX for literal token formats. Keep the failed 409 target event because it proves the defect was correlation/session state, not capacity.

8. Failure mode: replaying every captured asset

Raw recording contains CSS, JS, pixel, favicon, font, analytics, and business calls. CLI replay executes them sequentially/according to JMeter tree rather than reproducing a modern browser's rendering and connection scheduler. The server receives extra load that may not match the intended backend transaction.

Repair by excluding/removing noise or creating a separate authorized static-resource workload with explicit objective and concurrency.

9. Failure mode: captured browser concurrency becomes workload model

The recorder shows multiple requests arriving close together, so a tester sets six JMeter threads and calls that “browser concurrency.” This confuses one browser's connection behavior with population concurrency.

Return to Chapters 4 and 7: users, arrivals, pacing, and throughput targets come from workload requirements. Recorder timing can inform think-time discovery, but it is not authoritative load configuration.

10. Failure mode: localhost bypass means nothing records

Browser works fine against https://localhost:8443 even when JMeter recorder is stopped. That proves it is not using the proxy. Clear localhost/127.0.0.1 from browser “No proxy for” in the disposable profile, then verify the page fails when recorder is stopped and works when recorder is running.

11. Failure mode: browser reports unknown CA

If HTTPS proxying reaches JMeter but Firefox does not trust the generated recorder root CA, it can reject JMeter's dynamic server certificate. Compare the CA file fingerprint with the JMeter dialog, then import the exact CA into the disposable profile only.

Do not disable browser certificate validation globally.

12. Failure mode: filters silently hide a necessary business call

An overly broad exclude such as .*api.* removes a required /api/checkout sampler from the recording. The browser journey succeeds because traffic still passes through, but the stored JMX is incomplete.

Compare browser/target event list with recorded sampler list. Filters govern storage, not forwarding, so the target log can reveal requests missing from JMX.

13. Performance causality after recorder cleanup

Symptom Recorder/generator explanation Target explanation to distinguish Evidence
Raw JMX has many samples asset/noise capture real business fan-out recorded labels + target paths + filter config.
Clean replay 409s literal token/cookie or missing correlation target business regression variables/cookie manager + target note.
GUI authoring feels slow certificate generation/listeners/GUI target latency jmeter.log + generator CPU + target service time.
CLI throughput lower after adding resource retrieval generator/parser/concurrency work changed target slowdown same business target metrics + generator telemetry.
No sampler recorded but target was hit exclude/include filtered storage recorder failed network path target event + filter match.

14. Troubleshooting shortcuts to reject

  • Do not install the recorder CA system-wide to “fix” HTTPS quickly.
  • Do not disable TLS verification globally or RMI security.
  • Do not broaden Include to .* while normal browser activity is open.
  • Do not paste captured cookies/tokens into properties to make replay pass.
  • Do not add retries/long sleeps around stale-session failures.
  • Do not increase threads to compensate for a noisy raw recording.
  • Do not delete first-failure JTL/jmeter.log/target evidence before causal review.

Knowledge check

Why is system-wide recorder CA trust worse than profile-local trust?

Why can target logs show a request that is absent from the recorded JMX?

What does a replay 409 with a literal FLOW-00001 suggest?

How do you prove localhost is bypassing the proxy?

Why shouldn't captured asset timing determine user concurrency?

Next lesson

Checkpoint: isolate, record, clean, correlate, scan, remove trust

Lesson 5 turns the complete workflow into a reviewable evidence packet and requires independent proof that the final CLI plan no longer depends on recorder proxy or certificate trust.

Official references and version notes

Version and compatibility note

Version-sensitive statements were rechecked against current Apache JMeter primary documentation on 2026-09-05. The course baseline remains Apache JMeter 5.6.3 with a Java 17 JDK and no third-party JMeter plugins; JMeter 5.6.3 requires Java 8+. A JDK is preferred here because HTTPS recording needs the keytool utility. HTTP(S) Test Script Recorder is a local HTTP/HTTPS proxy, default port 8888. Include/Exclude patterns are regular expressions evaluated against the full host/port/path/query string; requests still pass through the proxy even when a filter prevents them from being stored. With Java 8+ dynamic certificate mode, JMeter generates per-host certificates signed by its temporary root CA; the default recorder certificate validity is 7 days via proxy.cert.validity. The exported ApacheJMeterTemporaryRootCA.crt is created when recorder certificates are generated and must be removed from browser trust after use. Anyone who can access the recorder keystore/private-key material while a browser trusts that CA has a powerful interception capability, so the mandatory lab imports it only into a disposable Firefox profile. During recording, the browser manages cookies; the cleaned JMeter replay plan needs an HTTP Cookie Manager. JMeter's HTTP samplers accept server certificates broadly for test flexibility, so the synthetic localhost target can use its own short-lived self-signed fixture certificate without importing that target certificate into the browser or OS trust store.

Keep the academy open

Support free, practical DevOps education.

Every lesson is designed to remain readable in a browser, downloadable from GitHub, and usable without a paid learning platform. Contributions help expand and maintain the curriculum.

Ethereum / ERC-20
0x716c4Ab160C4B66F31a28AE2448BfF68fc3a2ef0 Send only Ethereum/ERC-20 compatible assets to this address.