Checkpoint Lab — Recording Web Traffic, HTTP(S) Test Script Recorder, and Certificate Setup

1. Exact assumptions and hard ceilings

2. Setup and authorization/preflight

1. Create the 2-day localhost PKCS#12 fixture keystore with the Lesson 2 keytool command.
2. Compile/start RecorderFixture.
3. Verify http://localhost:8080/health and local HTTPS health using a loopback-only diagnostic client.
4. Record tool versions: JMeter 5.6.3, Java/Javac/Keytool version, Firefox version.
5. Confirm JMeter recorder port 8888 is not externally exposed/listening before Start.

3. Write predictions before touching browser trust

Prediction A — unfiltered browser traffic: a raw Begin page will create at least the business Begin/Finish requests plus synthetic CSS, JS, and image resource requests.

Prediction B — filtered HTTPS recording: strict host Include + static-extension Exclude stores only Begin and Finish business calls even though excluded assets still pass through the proxy.

Prediction C — clean replay: each loop gets a fresh FLOW_ID/CSRF_TOKEN and secure session cookie; three loops produce three accepted Finish events with no correlation failures.

Prediction D — trust cleanup: after deleting the disposable profile/removing its CA, no normal browser trust store was changed and the cleaned CLI JMX still runs because recorder CA trust is not required for replay.

4. Create and isolate the browser profile

Start a fresh Firefox profile directory, close normal Firefox windows, and verify its cookie/login state is empty. Configure proxy only after the recorder tree and strict target filters are prepared.

Record the profile directory path in the evidence packet so deletion can be independently verified.

5. Configure the recorder

Start Recorder and wait for certificate generation/dialog.

6. Certificate proof before import

Use keytool -printcert on the exact generated ApacheJMeterTemporaryRootCA.crt. Record:

• subject/issuer text;
• validity window;
• fingerprint;
• file path;
• that it is not currently trusted by the normal browser profile/OS for this lab.

Import only that CA into the disposable Firefox profile Authorities list.

7. Capture one HTTPS journey

1. Set Firefox HTTP/HTTPS proxy to 127.0.0.1:8888 and clear localhost bypass.
2. Navigate to https://localhost:8443/begin.
3. Submit the synthetic form once.
4. Stop Recorder immediately.
5. Save raw capture as raw-checkpoint.jmx.
6. Do not replay raw capture.

Inspect target events: Begin and Finish occurred. Inspect raw JMX: only the two business request samplers should be stored because the static extensions were excluded.

8. Remove recorder path/trust before plan cleanup

1. Stop Recorder.
2. Restore Firefox proxy settings.
3. Remove the recorder CA from the disposable profile or delete the entire profile.
4. Verify the profile path is gone if deletion is your rollback method.
5. Keep the raw JMX and JMeter-generated certificate files only in the controlled lab workspace long enough for evidence review; never treat the CA/private-key material as a reusable organizational CA.

9. Build exactly two cleaned business transactions

Test Plan
├── HTTP Request Defaults
│   https://localhost:8443
├── HTTP Cookie Manager
└── Thread Group — 1 user × 3 loops
    ├── Transaction Controller — Start Flow
    │   └── Begin — GET /begin
    │       ├── CSS Selector Extractor FLOW_ID
    │       │   selector: input[name=flow_id]
    │       │   attribute: value
    │       └── CSS Selector Extractor CSRF_TOKEN
    │           selector: input[name=csrf]
    │           attribute: value
    └── Transaction Controller — Complete Flow
        └── Finish — POST /finish
            flow_id=${FLOW_ID}
            csrf=${CSRF_TOKEN}
            email=student@example.invalid

Add assertions for required extracted variables, Begin HTTP 200, Finish HTTP 200, and accepted body marker. Remove unnecessary recorded browser headers and all literal captured dynamic values.

10. Preserve cleanup diff and secret scan

git diff --no-index -- raw-checkpoint.jmx cleaned-checkpoint.jmx > evidence/recording-cleanup.diff

python tools/scan_jmx.py raw-checkpoint.jmx
python tools/scan_jmx.py cleaned-checkpoint.jmx --clean

The raw inventory is expected to show literal captured flow/csrf values. The clean scan must not. If the clean scan hits a suspicious pattern, investigate; do not weaken the scanner just to make the checkpoint green.

11. Run clean plan without recorder/browser proxy

jmeter.bat -n `
  -t cleaned-checkpoint.jmx `
  -l results\checkpoint-clean.jtl `
  -j results\checkpoint-clean-jmeter.log

The Recorder remains stopped. Firefox is not needed. No recorder CA trust is needed. The plan connects directly to the synthetic HTTPS target.

12. Expected clean-run evidence

For 1 thread × 3 loops:

Transaction Controller rows may add reporting samples to JTL depending on its parent/additional settings, but target request count remains six business HTTP requests.

13. Verify predictions independently

• Use target event log rather than JTL alone to count real Begin/Finish requests.
• Use raw-versus-clean diff to prove static/browser-specific material was removed.
• Use cleaned JMX scan + manual review to prove no literal captured session values remain.
• Use Firefox certificate/profile inspection or profile-directory deletion to prove recorder trust rollback.
• Use JTL + matching jmeter.log + generator observation to prove the clean plan executed directly.

14. Required evidence packet

15. Final verification checklist

• Only localhost fixture traffic was recorded.
• Recorder bound to loopback and stopped after one journey.
• Recorder CA trust existed only in disposable Firefox profile.
• No normal/system trust store was modified.
• Raw JMX was preserved but never load-tested.
• Clean plan has exactly two business transactions.
• Cookie state is managed by HTTP Cookie Manager.
• Dynamic values are extracted from each Begin response.
• Cleaned JMX contains no literal captured FLOW/CSRF/session values or external hosts.
• CLI replay remains ≤1 thread × 3 loops and produces zero correlation failures.

16. Validity statement

17. Cleanup / rollback

1. Stop JMeter Recorder and local fixture.
2. Restore/remove disposable Firefox proxy settings.
3. Remove recorder CA from profile or delete the profile directory.
4. Delete disposable fixture fixture.p12 after evidence review if no longer needed.
5. If using a dedicated lab JMeter copy/launch directory, delete its recorder keystore/temporary CA artifacts after evidence review; do not indiscriminately delete shared installation files used by other tests.
6. Retain only sanitized/raw evidence according to your local policy; never commit real secrets/PII.

18. What Chapter 13 adds to the operating model

The performance-testing operating model now has a recording/trust contract: authorized host scope, disposable browser/profile, recorder proxy binding, CA fingerprint/trust location/expiry, include/exclude policy, raw-capture provenance, secret scan, refactoring diff, correlation proof, and certificate/proxy rollback are reviewable before the plan becomes load-test code.

Chapter 14 moves to REST and JSON API Performance Testing. The clean-plan discipline from this chapter is directly useful there: APIs are often best built manually from contracts, while recorder-derived HTTP calls should already be reduced to explicit endpoints, parameters, headers, assertions, correlation, and workload semantics before REST-specific analysis begins.

Knowledge check

Official references and version notes

• Component Reference — HTTP(S) Test Script Recorder — proxy, filtering, recording controller, certificate generation, CA trust, cookies, redirects, and UDV replacement.
• HTTP(S) Test Script Recorder tutorial — current recording-template workflow and browser proxy setup.
• Getting Started — Java/JDK requirement, keytool note for HTTPS recording, GUI/CLI conventions, and JMeter HTTP certificate behavior.
• Properties Reference — recorder and certificate properties such as proxy.cert.validity, proxy.ssl.protocol, proxy.pause, and redirect handling.
• Best Practices — using the recorder for rough drafts, variable replacement, and checking proxy routing.
• Apache JMeter downloads — current stable release and Java requirement.