feat: add custom subject dn and san to stress test. update error log … #71
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…output to specify cn that faild
This was
linked to
issues
Dec 22, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
EJBCA Easy REST Client - Feature Summary
This document outlines all the features and changes made to the EJBCA Easy REST Client stress testing commands.
OCSP Stress Test Command
Overview
The OCSP Stress Test Command (
ocspstress) provides multi-threaded OCSP (Online Certificate Status Protocol) stress testing capabilities against OCSP responders. It enables performance testing of OCSP infrastructure by sending concurrent requests and measuring response times and certificate status distribution.File:
/Users/srajala/git/ejbca-easy-rest-client/src/main/java/com/keyfactor/ejbca/client/stress/OcspStressTestCommand.javaFeatures
1. Multi-threaded OCSP Requests
Sends concurrent OCSP status lookup requests using a configurable number of threads to test OCSP responder performance under load.
Usage:
ocspstress --ocspurl "http://myhost:8080/ejbca/publicweb/status/ocsp" \ --ocspsnfile serial_numbers.txt \ --cacertfile ca.pem \ --threads 10 \ --waittime 100Parameters:
--ocspurl: OCSP responder URL (mandatory)--ocspsnfile: Serial number file (mandatory, two formats supported)--cacertfile: PEM-encoded CA certificate file (mandatory)--threads: Number of concurrent threads (mandatory)--waittime: Milliseconds to wait between requests per thread (mandatory)2. Dual Serial Number File Format Support
Supports two input file formats for maximum flexibility:
Format 1: Simple serial number list
0xprefix)#are ignoredFormat 2: Certificate info from --savecerts
serialNumber|issuerDn--savecertsoutputImplementation: Lines 328-377 in
loadCertificateInfo()method3. HTTP Method Support
Supports multiple OCSP request types:
Usage:
Implementation Details:
sendOcspRequest()method+→%2B/→%2F=→%3D+before Base64 decodingURLDecoder.decode().replaceAll(" ", "+")RFC 6960 Size Limitation:
4. Random Certificate Selection
Each thread randomly selects certificates from the loaded serial number list, simulating realistic OCSP lookup patterns.
Implementation: Lines 224-232 in
execute()method5. Configurable Test Duration
Control how long the stress test runs:
Unlimited duration (default):
ocspstress --ocspurl "..." --ocspsnfile file.txt --cacertfile ca.pem --threads 5 --waittime 100Runs indefinitely until interrupted (Ctrl+C)
Fixed duration:
ocspstress --ocspurl "..." --ocspsnfile file.txt --cacertfile ca.pem --threads 5 --waittime 100 --duration 60Runs for 60 seconds then stops automatically
Implementation: Lines 177-186 in
execute()method6. Nonce Extension Support
Adds OCSP nonce extension to requests for replay attack prevention.
Default nonce length: 32 bytes
Custom nonce length:
ocspstress --ocspurl "..." --ocspsnfile file.txt --cacertfile ca.pem --threads 5 --waittime 100 --ocspnoncelen 16Implementation: Lines 391-410 in
buildOcspRequest()method7. Random Wait Time
Optionally randomize the wait time between requests to simulate more realistic load patterns.
Fixed wait time (default):
Waits exactly 100ms between requests
Random wait time:
Waits between 0-100ms (random) between requests
Implementation: Lines 258-264 in
execute()method8. Comprehensive Performance Metrics
The stress test collects and reports detailed performance statistics:
Response Time Metrics:
Throughput Metrics:
Certificate Status Distribution:
Sample Output:
Implementation: Lines 526-576 in
reportStatistics()method9. Debug Request and Response Saving
Save OCSP requests and responses to disk for debugging and analysis using the
--saveocspflag.Usage:
ocspstress --ocspurl "..." --ocspsnfile file.txt --cacertfile ca.pem \ --threads 5 --waittime 100 --saveocsp /tmp/ocsp-debugBehavior:
ocsp-req-t{threadId}-r{requestNum}.derocsp-resp-t{threadId}-r{requestNum}.derParameters:
--saveocsp <directory>: Directory path to save OCSP requests and responses (optional)Implementation:
saveDebugRequest()methodsaveDebugResponse()methodexecute()method10. Real-time Progress Updates
Displays live progress updates during stress test execution showing request counts, success/failure rates, and throughput.
Usage:
Behavior:
Sample Output:
Parameters:
--progressinterval <seconds>: Progress update interval (default: 5 seconds, 0 to disable)Implementation:
totalRequestsCompleted,totalSuccessfulRequests,totalFailedRequests11. CSV/Markdown Output Formats
Export stress test results to CSV or Markdown files for automated testing and reporting.
Usage:
CSV Format:
Sample CSV:
Markdown Format:
Sample Markdown:
Parameters:
--outputformat <format>: Output format - 'console' (default), 'csv', or 'markdown'--outputfile <filename>: File path to save results (required when format is csv or markdown)Implementation:
writeResultsToCsv()method generates CSV outputwriteResultsToMarkdown()method generates Markdown output with formatted tables12. HTTPS with Client Authentication
Supports mutual TLS authentication via inherited base class functionality.
Usage:
ocspstress --authkeystore client.p12 --authkeystorepass password123 \ --hostname secure-ocsp.example.com:8443 \ --ocspurl "https://secure-ocsp.example.com:8443/ocsp" \ --ocspsnfile file.txt --cacertfile ca.pem --threads 5 --waittime 100Inherited from ErceCommandBase: SSL context creation with mutual TLS support
Code Organization
Class Structure
Inner Classes (Lines 113-138)
CertificateInfo: Stores serial number and issuer DNOcspTestResult: Aggregates failures, status counts, and response times per threadKey Methods
loadCertificateInfo()(lines 328-377): Parse serial number filesloadCaCertificate()(lines 382-396): Load CA certificate from PEMbuildOcspRequest()(lines 391-410): Generate OCSP request with noncesendOcspRequest()(lines 416-445): Send HTTP POST/GET requestparseOcspResponse()(lines 450-478): Parse OCSP response and extract statussaveDebugRequest()(lines 506-520): Save requests for debuggingreportStatistics()(lines 526-576): Generate performance reportRequired Libraries
Usage Examples
Example 1: Basic OCSP Stress Test
ocspstress --ocspurl "http://localhost:8080/ejbca/publicweb/status/ocsp" \ --ocspsnfile serials.txt \ --cacertfile myca.pem \ --threads 10 \ --waittime 50Runs indefinitely with 10 threads, 50ms wait between requests
Example 2: Time-Limited Test with Metrics
ocspstress --ocspurl "http://localhost:8080/ejbca/publicweb/status/ocsp" \ --ocspsnfile serials.txt \ --cacertfile myca.pem \ --threads 20 \ --waittime 100 \ --duration 300 \ --randomwaitRuns for 5 minutes with 20 threads and random wait times
Example 3: HTTPS with Client Auth and Debug
mkdir ./ocsp-requests ocspstress --authkeystore client.p12 --authkeystorepass secret \ --hostname secure-ocsp.example.com:8443 \ --ocspurl "https://secure-ocsp.example.com:8443/ocsp" \ --ocspsnfile issued_certs.txt \ --cacertfile ca.pem \ --threads 5 \ --waittime 200 \ --duration 60 \ --ocspnoncelen 16Uses client certificate auth, saves debug requests, custom nonce length
Example 4: Integration with X509 Stress Test
Seamless workflow from certificate issuance to OCSP testing
Build Status
✅ Successfully compiled and tested
X509 Stress Test Command
This document outlines all the features and changes made to the X509StressTestCommand for EJBCA stress testing.
Features Added
1. Certificate Revocation After Issuance (
--revoke)Line References: 107, 158-161, 213-214, 351-360, 686-741
Automatically revokes certificates immediately after successful issuance to test revocation performance and certificate lifecycle.
Usage:
Behavior:
Implementation:
revokeCertificate()method at lines 711-769 handles the revocation/ejbca/ejbca-rest-api/v1/certificate/{issuer_dn}/{serial_number}/revoke?reason=UNSPECIFIED--backdaterevoke: URL does NOT includedateparameter (current time used by server)--backdaterevoke: URL includes&date={notBefore}parameterescapeInvalidUrlCharacters()helper method at lines 771-773 for URL encoding1a. Backdated Revocation (
--backdaterevoke)Line References: 107, 160-161, 214, 354, 686-741
Allows backdating certificate revocation to the certificate's validity start date (notBefore) instead of using the current time. Must be used in conjunction with
--revokeflag.Usage:
Behavior:
--backdaterevokeis set along with--revoke, revocation uses the certificate's notBefore date--backdaterevoke, revocation uses current timestamp (default behavior)Implementation:
backdateRevocationflag parsed at line 178revokeCertificate()method at line 286&date=parameter to URL only when flag is true (lines 729-734)certificate.getNotBefore()and converts to OffsetDateTime with UTC timezone (line 731)StressTestResultinner class (lines 117-125) tracks issuance and revocation failures separatelyURL Format:
Error Prevention:
Without
--backdaterevoke(default):With
--backdaterevoke:2. Custom Subject DN Support (
--subjectdn)Line References: 83, 126-127, 147-152, 386-410
Allows specifying a custom Subject DN for certificates instead of using the default
CN=<prefix>_<threadId>_<certId>_<postfix>.Usage:
Behavior:
CN=Test,O=OrgbecomesCN=ErceStressTest__Test_0_0,O=Org(for first cert)applyPrefixPostfixToCN()at lines 474-497 handles the transformation3. Subject Alternative Name (SAN) Support (
--san)Line References: 84, 128-129, 154-159, 389-411, 444-449
Adds Subject Alternative Name extension to certificates with support for DNS names, IP addresses, and other SAN types.
Usage:
Behavior:
dnsName=example.combecomesdnsName=ErceStressTest__example.com_0_0applyPrefixPostfixToSAN()at lines 499-523 handles the transformationgenerateCertificateRequest()at lines 444-4494. Empty Subject DN with SAN Only
Line References: 388-399, 412, 422-423
When only
--sanis provided without--subjectdn, the CSR is created with an empty subject DN.Usage:
Behavior:
new X500Name("")5. Certificate History Testing (
--history)Line References: 85, 130-131, 161-175, 229, 243-244, 311-325, 364-372, 413-445
Generates multiple certificates per end entity with unique keys to test certificate renewal and history in EJBCA.
Usage:
Behavior:
1 + historyCountcertificatesnumberOfThreads × requestPerThread × (1 + historyCount)Statistics Output:
6. Enhanced Error Reporting with CN
Line References: 91-92, 255-256, 266, 275, 369, 376, 426, 443, 525-542
Error messages now include the Common Name (CN) from the subject DN to easily identify failed enrollments.
Before:
After:
Implementation:
subjectDnsarray stores DN for each certificate (line 92, 376, 443)extractCNForErrorMessage()method extracts CN from DN (lines 525-542)Technical Implementation Details
Data Structures
Key Methods
generatePayloads()- Lines 362-456certsPerEntity = 1 + historyCountrequestPerThread × certsPerEntitygenerateCertificateRequest()- Lines 458-472applyPrefixPostfixToCN()- Lines 474-497CN=<prefix>_<value>_<threadId>_<certId>_<postfix>applyPrefixPostfixToSAN()- Lines 499-523dnsNameattributesextractCNForErrorMessage()- Lines 525-542, CN=valueExecution Flow
Combined Usage Examples
Example 1: Full Feature Set
Result:
CN=Test_User_0_0_v1,OU=Engineering,O=Keyfactor,C=USdnsName=Test_user.example.com_0_0_v1,ipAddress=10.0.0.1Example 2: SAN-Only Certificates
Result:
dnsName=ErceStressTest__api.example.com_0_0Example 3: History Testing
Result:
Example 4: Revocation Testing
Result:
Example 4a: Backdated Revocation Testing
Result:
Sample Output:
6. Certificate Tracking and Bulk Revocation (
--savecertsand--revokefile)Line References: 108-109, 135-159, 207-210, 264-265, 349-351, 372, 397, 446, 491-494, 816-1001
Enables tracking of all issued certificates and performing mass revocation from a saved certificate list without enrollment.
Usage - Save certificates during issuance:
Usage - Bulk revocation from saved file:
Behavior:
--savecerts <filename>: Saves serial number and issuer DN of all successfully issued certificates to fileserialNumber|issuerDn)--revokeflag--revokefile <filename>: Performs bulk revocation from previously saved certificate list--revokefileis used, NO enrollment occurs - only revocation--threads)--backdaterevokecan be used with--revokefile(uses current time as revocation date)Implementation:
CertificateInfoinner class (lines 135-159) stores serial number and issuer DNtoString()method formats toserialNumber|issuerDnfromString()method parses from file formatStressTestResultmodified (line 133) to includeList<CertificateInfo> issuedCertificatessaveCertificatesToFile()method (lines 824-838) writes certificates to fileloadCertificatesFromFile()method (lines 843-863) reads certificates from fileperformBulkRevocation()method (lines 868-1001) handles bulk revocation modeFile Format Example:
Statistics Output (Bulk Revocation Mode):
Example 4b: Save Certificates with Immediate Revocation
Result:
issued_certs.txtfor later referenceExample 4c: Bulk Revocation Only
Result:
Example 5: Combined Features
Result:
test_certs.txt7. Real-time Progress Updates
Displays live progress updates during stress test execution showing certificate counts, success/failure rates, and throughput.
Usage:
Behavior:
--revokeis used, also shows revocation counts (successful/failed)current/expectedwith percentageSample Output (Normal Mode):
Sample Output (With Revocation):
Sample Output (Bulk Revocation Mode):
Parameters:
--progressinterval <seconds>: Progress update interval (default: 5 seconds, 0 to disable)Implementation:
totalIssuanceAttempts,totalSuccessfulIssuances,totalFailedIssuances,totalSuccessfulRevocations,totalFailedRevocations8. CSV/Markdown Output Formats
Export stress test results to CSV or Markdown files for automated testing and reporting.
Usage:
CSV Format (Issuance Mode):
Sample CSV (Issuance Mode):
CSV Format (Bulk Revocation Mode):
Markdown Format (Issuance Mode):
--revokeis usedSample Markdown (Issuance Mode):
Markdown Format (Bulk Revocation Mode):
Parameters:
--outputformat <format>: Output format - 'console' (default), 'csv', or 'markdown'--outputfile <filename>: File path to save results (required when format is csv or markdown)Implementation:
writeIssuanceResultsToCsv()method generates CSV output for issuance modewriteIssuanceResultsToMarkdown()method generates Markdown output for issuance modewriteRevocationResultsToCsv()method generates CSV output for bulk revocation modewriteRevocationResultsToMarkdown()method generates Markdown output for bulk revocation modeCode Organization
Imports (Lines 15-18, 41-49)
File I/O for certificate tracking:
java.io.BufferedReader,BufferedWriter,FileReader,FileWriterBouncyCastle ASN.1 classes for SAN extension support:
ASN1EncodableVector,DERSequence,DERSetExtension,Extensions,ExtensionsGeneratorGeneralNamesConstants (Lines 78-85, 108-109)
All CLI argument definitions including:
SAVECERTS_ARG = "--savecerts"REVOKEFILE_ARG = "--revokefile"Inner Classes (Lines 123-159)
StressTestResult(lines 123-133): Aggregates issuance failures, revocation failures, and issued certificatesCertificateInfo(lines 135-159): Stores and serializes certificate serial number and issuer DNHelper Methods (Lines 474-542, 816-863)
applyPrefixPostfixToCN()(lines 474-497)applyPrefixPostfixToSAN()(lines 499-523)extractCNForErrorMessage()(lines 525-542)saveCertificatesToFile()(lines 824-838)loadCertificatesFromFile()(lines 843-863)performBulkRevocation()(lines 868-1001)Main Logic (Lines 362-456)
Payload generation with history support
Build Status
✅ All features compile successfully with Gradle
BUILD SUCCESSFUL in 7s 4 actionable tasks: 2 executed, 2 up-to-date