JMeter SSLHandshakeException

SSLHandshakeException in JMeter

Symptom

Samples fail with TLS-related messages, often wrapped as Non HTTP response errors:

• javax.net.ssl.SSLHandshakeException
• PKIX path building failed / unable to find valid certification path
• Received fatal alert: handshake_failure
• javax.net.ssl.SSLException: Unsupported or unrecognized SSL message (TLS aimed at a port that answers with plain HTTP)
• During recording: browser unknown_ca or HTTPS pages never record cleanly (recorder best practices)

HTTP may work in a browser that already trusts the corporate CA, while JMeter’s JVM does not.

Common causes

Cause	Notes
Untrusted server certificate	Lab/self-signed or private PKI not in the JVM truststore JMeter uses
Hostname / SNI mismatch	Certificate CN/SAN does not match the server name in the sampler
TLS version or cipher mismatch	Server requires TLS 1.2+; client restricted by JVM or properties
TLS aimed at a plain HTTP port	Unsupported or unrecognized SSL message; the server’s plain HTTP reply cannot be parsed as a TLS handshake
Client certificate required	Mutual TLS; keystore not configured on the HTTP Request / system properties
Recorder without JMeter CA	HTTPS recording needs ApacheJMeterTemporaryRootCA trusted (proxy tutorial)
RMI SSL between engines	Distributed mode since JMeter 4.0 defaults to SSL for RMI (remote testing) - different from HTTP TLS

Fix (ordered)

Load against HTTPS APIs

1. Confirm the URL works in a browser and with curl using the same hostname.
2. Ensure the sampler uses https and the correct port (usually 443).
3. Import the issuing CA (or server cert, if appropriate for your org policy) into the truststore used by the same Java that launches JMeter.
4. Restart JMeter after truststore changes.
5. Align system clock (skew breaks cert validity).
6. For mTLS, configure client keystore settings on the HTTP Request / related SSL properties (properties reference).
7. Avoid disabling certificate verification outside isolated labs - it hides real misconfiguration.

Unsupported or unrecognized SSL message

This variant is a protocol/port mismatch, not a certificate problem:

1. Check the sampler’s protocol and port. https against a port that serves plain HTTP triggers this error, because the server answers with HTTP text the TLS layer cannot parse.
2. Confirm which protocol the port actually serves: curl -v http://host:port/ versus curl -vk https://host:port/.
3. Fix the sampler, or HTTP Request Defaults, to match: http for plain HTTP ports, https for TLS ports (usually 443).
4. Behind load balancers that terminate TLS, target the frontend address with https; the backend ports behind it are usually plain HTTP and reject TLS.

Recording HTTPS

1. Start the HTTP(S) Test Script Recorder.
2. Install ApacheJMeterTemporaryRootCA.crt from the JMeter launch directory into the browser trust store.
3. If certs are stale, regenerate per component reference (delete proxyserver.jks when documented).
4. Best practices: unknown_ca usually means the browser has not accepted the JMeter proxy certificate.

Distributed RMI SSL

1. Run create-rmi-keystore scripts and distribute rmi_keystore.jks to controller and workers.
2. Do not confuse RMI SSL failures with HTTP SSLHandshakeException against the SUT - check whether the error is on jmeter-server startup or on an HTTP sampler.

Related tools and topics

Resource	Use when
HTTP recorder	Recording HTTPS
Properties cheat sheet	SSL-related properties
Remote testing	RMI SSL keystores
Non HTTP response code	How JMeter wraps SSL errors

Frequently asked questions

Why does the browser work but JMeter fails SSL?

Browsers use the OS trust store. JMeter uses the JVM trust store unless configured otherwise. Corporate CAs often exist in one but not the other.

Is unknown_ca the same as SSLHandshakeException?

Related family: unknown_ca during recording means the browser rejected the JMeter MITM CA. Load-test SSLHandshakeException usually means JMeter rejected the server certificate (or mTLS failed).

Can I ignore SSL errors for performance tests?

Only in controlled non-production labs, and document it. Production-like tests should use proper trust material so TLS cost and failures are realistic.

What does Unsupported or unrecognized SSL message mean in JMeter?

It means JMeter tried to speak TLS to a port that answers with something else, usually plain HTTP. The server’s reply cannot be parsed as a TLS handshake. Check the sampler’s protocol and port, and use https only against ports that actually serve TLS.

Continue Learning

→

Next Practical Step

Identify whether the failure is HTTP sampler TLS, recorder CA, or distributed RMI SSL, then apply the matching section above.

📖

Related Reference

• HTTP recorder
• Remote testing
• Properties reference