playing suites with HTTPS: certificate problem / suite stops

simmerl

Hi,
i am using Sahi V3 Release 2010-06-11, Windows XP SP3, Firefox 3.6.8, JRE Version 1.6.0_21.
There are and some problems with HTTPS checks played in suites.

1) Starting with a fresh installation of sahi and a running sahi proxy in the background, I am able to import ssl certificates from whatever site I want. The sahi-signed certs are saved properly under \userdata\certs. Re-visiting each of these sites shows up the site without prompting me. All certs in Sahi SSL Manager are marked green. OK.

2) Starting from Site h_ttps:/meine.deutsche-bank.de/trxm/db/init.do?logintab=iTAN I record the following script test.sah (please ignore the german Umlaut, the script works). I am able to start the script from the sahi controller.

_setValue(_textbox("account"), "12345");
_click(_submit("Login ausf�hren"));

Now i create a suite test.suite...

db02.sah h_ttps:/meine.deutsche-bank.de/trxm/db/init.do?logintab=iTAN

...and call this suite from a DOS batch file test.bat:

java -cp c:\sahi\lib\ant-sahi.jar net.sf.sahi.test.TestRunner c:\sahi\userdata\scripts\test.suite "C:\Program Files\Mozilla Firefox\firefox.exe" "h_ttps:/meine.deutsche-bank.de/trxm/db/init.do?logintab=iTAN" default localhost 9999 3 firefox.exe "-profile C:\sahi\userdata\browser\ff\profiles\sahi$threadNo -no-remote"

Problem 1: This brings up Firefox with a warning again for exactly the same sahi-signed certificate I confirmed in step 1). Why? From my understanding, this should not be neccessary.

Problem 2: After I have accepted this certificate (for the second time) and restart test.suite, the page is loading correctly (=without prompting me), but the suite is not running at all. After a while, firefox is being closed by sahi.
The sahi log contains only one line:

JSERROR
Script did not start within 150 seconds. at 18.08.2010 15:13:07

I tested around and found out that the suite is running properly if I call firefox without the command line arguments

"-profile C:\sahi\userdata\browser\ff\profiles\sahi$threadNo -no-remote"

Do you have any idea what is going wrong?

Thanks for your help!
Simon

P.S.: I am sorry to mask the https as h_ttps, but as a new user, i am not allowed to post urls...

narayan

Hi Simon,

This is a known problem with a slightly painful work around. Here is the explanation:

When Sahi runs a suite on firefox, it spreads it across 10 different profiles that Sahi has pre-created during the first time Sahi ran. These profiles are present in sahi/userdata/browser/ff/profiles/ directory as sahi0 through sahi9.

Each profile uses its own certificate store and certificate exception, which is why you needed to add it to the opened profile again. But most probably you only accepted the certificate for your website and did not accept the one for sahi.example.com, which is the common dummy domain through which Sahi keeps track of sessions.

Certificate exceptions are stored in a file called cert_override.txt in your default profile. The profile path may be something like this:
C:\Users\narayan\AppData\Roaming\Mozilla\Firefox\Profiles\l0ipiru7.default

If you copy over the cert_override.txt file to each of these 10 profile directories (sahi0 through sahi9), the certificates will be accepted automatically during playback.

Let us know if this works for you.

Regards,
Narayan

PS: Sahi Pro, which releases by August end, has automatic acceptance of SSL certificates. http://sahi.co.in/w/sahi_pro

simmerl

Hi Narayan,

thank you very much - that worked for me.

Perhaps you can extend Sahi's start procedure so that it copies "cert_override.txt" in each of the 10 profile folders? Without this file, sahi suites will never run on https sites.

Another idea: wouldn't it be better to create the sahi$ThreadNo folders on runtime? This would ensure that every suite starts with a fresh environment - without fetching content from cache. Checking the performance of websites would be more meaningful this way.

Thanks again,

Simon

narayan

Hi Simon,

Copying the profiles before a suite is what we would like to do. There is one more detail though. The profile files are copied over from a template profile provided in sahi/config/ff_profile_template. If you copy your cert_override.txt file to ff_profile_template, and delete all the profile directories sahi0 through sahi9, it will automatically copy over the correct files during the next start of Sahi proxy.

Regards,
Narayan

simmerl

Hi Narayan,

did the handling of certificates change in the meantime?
In my new company i am using Sahi again. I (happily) noticed the following:

* Starting Firefox from the Dashboard uses always profile "sahi0"
* Each HTTPS-Site i visit presents me a certificate warning, I accept all of them. The SSL Manager shows each certificate as marked green.
* Restarting Sahi spreads the files cert8.db, cert_override.txt nad key3.db automatically from "sahi0" to "sahi1" to "sahi9" .

=> what is the purpose of ff_profile_template exactly? Does it only serve prefs.js for the creation of sahi0-9?
=> is there any need to start the browser with the ff_profile_template, as you described some time ago here?
http://sahi.co.in/forums/viewtopic.php?pid=1101#p1101

It would be good if you could clarify this - thanks a lot!

Regards,
Simon

Sumitra

Hi simmer1,

Yes,there are many changes done in the new releases regarding cerificates. You can try using the latest version of Sahi.

As Narayan has mentioned here:

http://sahi.co.in/forums/viewtopic.php?pid=1101#p1101

You dont have to start the browser with the ff_profile_template, the content of this template are just copied to <sahi-home>\userdata\browser\ff folder and renamed as Sahi(0-9).

This is how Sahi works:

For eg:

If you accept certificates for https://twitter.com at the first instance , then you dont have to accept the certificates if you are using https://twitter.com for a different profile(ie changing the profile to sahi1 in browserTypes.xml for firefox).The certificates are automatically been accepted for sahi1 profile.

If the https urls are different then if you are tying to use a different profile then you will have to accept certificates for each one of them.

Regards
Sumitra

simmerl

Hello Sumitra,

thanks for this explanation. This means, the "sahi0" directory acts as a kind of "template" folder for the other profile folders - on each start, Sahi makes sure the certificate informations are the same in all these folders.

In conclusion, there are two template mechanisms:
- if i want to change general FF settings, I have to edit the prefs.js in ff_profile_template
- if i want to accept sahi-signed certificates, I have to start FF with sahi0 profile.

Wouldn't it be an idea to also copy prefs.js from sahi0 to sahi1-9? = to use sahi0 as a general folder? Personally, I don't see a reason for ff_profile_template (which serves only 1 file).

Thanks & regards,

Simon