Loadtest fails with mattermost deployment using signed cert from internal CA for TLS

[rraghav13]

Loadtest tool fails when trying to ping my mattermost instance under TLS by self signed cert. This is the error {"level":"error","ts":1548197159.254348,"caller":"loadtest/client.go:82","msg":"Did you follow the setup guide and modify loadtestconfig.json?","error":"https://<siteurl>/api/v4/system/ping: model.client.connecting.app_error, Get https://<siteurl>/api/v4/system/ping: x509: certificate signed by unknown authority"} Error: run test failed: Unable create admin client. I tracked down the file that sets properties for http.client and made the modification in the Transport object to skip TLS verification for testing purposes but the error persists. Below is the transport object in run.go

transport := &http.Transport{
                Proxy: http.ProxyFromEnvironment,
                TLSClientConfig: &tls.Config{
                        InsecureSkipVerify: true,
                },
                DialContext: (&net.Dialer{
                        Timeout:   30 * time.Second,
                        KeepAlive: 30 * time.Second,
                        DualStack: true,
                }).DialContext,
                MaxIdleConns:          cfg.ConnectionConfiguration.MaxIdleConns,
                MaxIdleConnsPerHost:   cfg.ConnectionConfiguration.MaxIdleConnsPerHost,
                IdleConnTimeout:       time.Duration(cfg.ConnectionConfiguration.IdleConnTimeoutMilliseconds) * time.Millisecond,
                //TLSHandshakeTimeout:   10 * time.Second,
                ExpectContinueTimeout: 1 * time.Second,
        }

Can you advise as to how to resolve this issue?

[icelander]

@raghav130593 Does this reproduce if you trust the self-signed cert on all your systems?

[lieut-data]

Hey @raghav130593, it looks like we have a stray invocation of getAdminClient that takes a default http.Client instead of the one you found and modified above.

If you make the same changes in https://github.com/mattermost/mattermost-load-test/blob/master/loadtest/setup_server.go#L57-L60, you should be able to bypass the certificate checks.

This is probably something we should expose in the configuration to make explicit and easy.

[rraghav13]

@icelander I should have clarified. It is not self-signed but signed by our internal CA. My bad. So, basically, if I point requests to my CA trust chain, that should do the deal.

[rraghav13]

@lieut-data Thanks. That should work.

[agnivade]

Hi @raghav130593 - just wanted to quickly check if you were able to get it to work ? Please let us know. Thanks.