fatal alert : certificate_unknown in jmeter while recording native mobile application

Question

I am trying to record the native app performance testing by using jmeter HTTP(S) Test Script Recorder and after installing ApacheJMeterRootCA certificate in mobile device and also configuring Proxy settings, I am getting certificate_unknown error whenever I open the app and try to use it

Note : JDK8 and JMeter 4.0 is used

Answer 1

Assuming correct JMeter configuration (i.e. you have imported JMeter's self-signed certificate onto device and the device proxy configuration matches HTTP(S) Test Script Recorder settings) you should be able to record your application traffic normally.

Unless you're using latest Android versions (Nougat 7 or higher) where you need to amend your application source code in order to configure the application to trust user certificates.

1. Add the next line to your application manifest (under application tag)

   android:networkSecurityConfig="@xml/network_security_config"
   

2. Add network_security_config.xml file under res folder of your application and put the following code into it:

   <?xml version="1.0" encoding="utf-8"?>
   <network-security-config>
       <debug-overrides>
           <trust-anchors>
               <!-- Trust user added CAs while debuggable only -->
               <certificates src="user" />
           </trust-anchors>
       </debug-overrides>
   </network-security-config>
   

3. Rebuild your application and run it in debug mode - now JMeter should be able to capture the requests.

More information:

• Bypassing Android’s Network Security Configuration
• Recording Using Android Devices