ASM JMeter monitors fail with "7019: Received fatal alert: handshake_failure"

Products

• CA App Synthetic Monitor

Issue/Introduction

Customers using JMeter script monitors may observe intermittent or consistent failures from specific public monitoring stations. The error logs or monitor reports show the following:

• Error Code: 7019: Received fatal alert: handshake_failure
• Exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
• Backend Logs: Server-side logs may indicate "Certificate required and not sent", even when a client certificate is configured in the monitor.
• Isolation: The issue often affects JMeter scripts specifically, while standard HTTPS monitors to the same endpoint continue to work.

Cause

A backend update to ASM public monitoring stations has introduced a compatibility issue with older JMeter engines. Specifically, monitors configured to run on JMeter 4.0 or earlier may fail to correctly pass the SSL client certificate during the handshake process on upgraded stations.

Resolution

To resolve the handshake failure, the monitor script must be updated to run on JMeter 5.0.

Steps to Fix:

1. Log in to the DX ASM SaaS Console.
2. Navigate to Settings > Monitors and select the affected JMeter monitor.
3. Update the version from 4.0 to 5.0 in the script file.
4. Upload the modified script file and save the monitor.
5. Run a Check Now from a station that was previously failing to verify that the SSL handshake now completes successfully.

Example from script file:

<jmeterTestPlan version="1.2" properties="4.0" jmeter="5.0">

Note: If the monitor still fails after the upgrade, ensure that any associated .jmx script properties or dependencies are compatible with the JMeter 5.0 environment.