18 January 2026:


This forum is now archived and is in read-only mode. Please continue discussions on our improved new Sahi Pro Community forum.



Sahi Pro is an enterprise grade test automation platform which can automate web, mobile, API, windows and java based applications and SAP.

HTTPS - using client certificate

rj412rj412 Members
edited November -1 in Sahi - Open Source
Hello,

I have multiple client certificates that were generated by the company required to use to access our HTTPS site, each certificate has its own identifier with proper access rights. All certificates were then imported to FF;
for example to access h_ttps://banksite4
-a FireFox popup will then be displayed requesting the end-user to choose which client certificate to use:
-user1-teller;
-user2-Mgr;
-user3-IT;
etc...

certificate is a PKCS #1 SHA-1 With RSA Encryption (Subject Public Key Algorithm)

without Sahi Proxy - I can access the site with FF 3.5.9 on Ubuntu Karmic 9.10 (manually selecting which client certificate to use - FireFox popup/pull down menu "Choose a certificate to present as identification").
I would like to simulate the same with Sahi - even if it means that I can only have/use a certificate at a time by renaming the cert file.

I went through the forum and tried several things already but to no avail.
-copied the user1.p12 into /userdata/certs as banksite4

-modified /config/sahi.properties and entered
ssl.client.keystore.type=PKCS12 (also tried PKCS1)
ssl.client.cert.path=../certs/banksite4
#ssl.client.cert.password=sahipassword (no password so I left it uncommented)

-restarted the browser and shell script and I am getting the following msg

browser: Cannot communicate securely with peer: no common encryption algorithm(s).
(Error code: ssl_error_no_cypher_overlap)
console: java.io.IOException: Invalid keystore format

Please advice.
How do I use/specify a client certificate with Sahi.

Thanks,
rj412

Comments

  • rj412rj412 Members
    bump....
    How do I use/specify a client certificate with Sahi?

    setup sahi.properties:
    ssl.client.keystore.type=PKCS12
    ssl.client.cert.path=./userdata/certs/banksite4

    also tried to convert the certificate from PKCS12 to JKS (with portecle-1.5), then setup sahi.properties:
    ssl.client.keystore.type=JKS
    ssl.client.cert.path=./userdata/certs/banksite4
  • rj412rj412 Members
    Narayan - thanks again for your help. This is also now workign. You may close this discussion as well.

    But I do want to share this info to others, who may or are having SSL issue when using self-signed client certificate.

    After several email exchanges with Narayan. He figured out what the problem is.
    "The problem is that when you created/exported to PKCS12 format, you specified a blank password. Java's SSL implementation bombs when the password is blank (looks like a bug in Java). When creating/exporting, give it a password, say mypwd, and specify that password in sahi.properties:

    #SSL
    ssl.client.keystore.type=PKCS12
    ssl.client.cert.path=certs/sampleUser.p12
    ssl.client.cert.password=mypwd
  • narayannarayan Administrators
    Hi rj412,

    Glad to hear that this works for you now!

    To add to your comments, if originally you only had a PKCS12 file without a password, you can use this to add a password for the certificate that Sahi will use.
    > openssl pkcs12 -in sampleUser.p12 -out sampleUser_temp.pem
[Give a simple password for sampleUser_temp.pem]

>openssl pkcs12 -export -in sampleUser_temp.pem -out sampleUser_for_sahi.p12
[Make sure you give a password for sampleUser_for_sahi.p12]

    Use sampleUser_for_sahi.p12 in sahi.properties.

    Regards,
    Narayan
This discussion has been closed.