HTTPS(PI_HTPS)

Function

The HTTPS (PI_HTPS) record stores information about HTTPS service response time. This is a multi-instance record.

Default and changeable values

ItemDefault valueChangeable
Collection Interval360Y
Collection Offset0Y
LogNoY
LOGIF(Blank)Y

ODBC key fields

PI_HTPS_MSR_COND_ID

Lifetime

None

Record size

Fields

View name
(Manager name)
DescriptionSummary ruleFormatDeltaData source
Data Transfer Time
(DATA_TRANS_TIME)
Data transfer time (seconds) ((7) in Figure 9-5)AVGdoubleNoProbe Daemon
DNS Time
(DNS_TIME)
Data transfer time (seconds) ((4) in Figure 9-5)AVGdoubleNoProbe Daemon
HTTP Time
(HTTP_TIME)
HTTP time (seconds) ((3) in Figure 9-5)AVGdoubleNoProbe Daemon
Request Count
(REQ_COUNT)
Number of requests issued (count)AVGdoubleNoProbe Daemon
Server Processing Time
(SERV_PROCESS_TIME)
Server processing time (seconds) ((6) in Figure 9-5)AVGdoubleNoProbe Daemon
Setup Time
(SETUP_TIME)
Setup time (seconds) ((2) in Figure 9-5)AVGdoubleNoProbe Daemon
TCP Connection Time
(TCP_CON_TIME)
TCP connection time (seconds), including the time required for establishing an SSL connection ((5) in Figure 9-5)AVGdoubleNoProbe Daemon
Throughput
(THROUGHPUT)
Resource transfer throughput (bits/second). This is determined by the total size of resources and the data transfer time.AVGdoubleNoProbe Daemon
Total Amount of Data
(TOTAL_DATA_SIZE)
The total amount of data transferred between the HTTPS probe and the measurement-target server via the TCP connection (bytes). For the data transferred via an SSL-protected connection, the total amount of text data is calculated. The amount of data associated with server authentication for establishing an SSL connection and the amount of data associated with an SSL handshake are not included.AVGdoubleNoProbe Daemon
Total Resource Size
(TOTAL_RES_SIZE)
Size of acquired resources (bytes)AVGdoubleNoProbe Daemon
Total Response Time
(TOTAL_RESP_TIME)
Total response time (seconds) ((1) in Figure 9-5)AVGdoubleNoProbe Daemon
Note:
If the page to be measured contains embedded images and frames, and if the depth of measurement condition is 2 or greater, measurement is executed more than once. In such a case, the value of each item, except the throughput, is the sum of the results obtained by the multiple measurements.

The following figure shows the HTTPS sequence.

Figure 9-5 HTTPS sequence

[Figure]

HTTPS operating environment and notes

An HTTPS probe establishes an SSL-protected connection with the server that provides the target service. Then the HTTPS probe issues an HTTP request to the URL specified on the connection, uses the GET method to acquire the page or the POST method to register data, and measures the response time. Note that when the SSL connection is established, server authentication is performed to confirm that the connection target is a reliable HTTP server.

The following describes, and provides notes on, an HTTPS operating environment.

Web authentication

The Basic Authentication method is used.

Cookie

PFM - Agent for Service Response accepts cookies based on Netscape Communication's specifications. The information sent as a cookie from the HTTP server is stored in the Cookie file that is created for each measurement condition. The Cookie files remain undeleted even after measurement is completed. If measurement cannot be performed correctly due to a change made to the contents of a measurement condition, delete the Cookie file for that measurement condition, which can be identified by the measurement condition ID. The following is the naming convention for Cookie files:

cookies_<measurement-condition-ID>

Cookie files are stored in the following folder:

installation-folder\agtv\probe\probedata\http

Program execution

Plug-ins, JavaScripts, and applets are downloaded but not executed.

Depth

For example, specifying a depth of 2 acquires the pages displayed in the resources and frames that are embedded in the page at the specified URL. No linked pages are acquired. PFM - Agent for Service Response repeats the acquisition of resources and frames embedded in the acquired page or frame as many times as the specified value.

For the embedded resources and frames, PFM - Agent for Service Response analyzes the acquired HTML, and acquires the resources and frames that are specified by the value of the tag and attribute shown in the table below.

Table 9-16 Embedded resources and frames to be acquired

Tag nameAttribute name
appletcode
framesrc
iframesrc
imgsrc
scriptsrc

Use of proxy

If acquiring the Web page specified by the URL and the embedded resources and frames involves use of a proxy for only part of the acquisition target, measurement cannot be performed.

Cipher strength

The table below shows the encryption types supported by the HTTPS probe. You cannot access a page protected with unsupported cipher strength.

Table 9-17 Supported encryption types

Cryptographic algorithmKey length
Triple-DES168
RC4128
RC2128
RC4-5656
DES56
RC4-4040
RC2-4040

Server authentication

For server authentication, PFM - Agent for Service Response verifies the validity period of a server certificate sent from the HTTP server and confirms that the server certificate was issued from an authorized Certificate Authority. To verify the server certificate, the root certificate of either the Certificate Authority that issued the server certificate or its higher-level Certificate Authority is required. Because the root certificate has a validity period, you need to re-install the root certificate before it expires. If there is no root certificate or if the server certificate has expired, server authentication fails.

To install a root certificate, use the following procedure:

Acquire a root certificate:
Export a PEM root certificate from a Web browser. The following shows an example using Internet Explorer 8.
  1. Select Tools, Internet Options, and then click the Contents tab.
  2. Click the Certificate button. Then, in the dialog box that opens, click the Trusted Root Certification Authorities tab.
  3. In the list, select the root certificate of the Certificate Authority that issued the server certificate.
    To check the Certificate Authority that issued the server certificate, open the monitoring target Web page in Internet Explorer, and then click the key icon on the status bar. Then look at the information on the Details page.
  4. Click the Export button to start the certificate export wizard.
    Specify the settings as instructed by the export wizard.
    For the format of the exported file, select Base64 encoded X.509(.CER).
    For the file name, enter c:\cacert.cer. The extension .cer is automatically added.
Install the root certificate:
Change the extension of the exported root certificate (cacert.cer) to .pem, and then copy the file to installation-folder\agtv\probe\cert.
Note that the cacert.pem file can contain multiple root certificates. To add a root certificate to the existing cacert.pem file, use a text editor to copy the contents of the exported root certificate (from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----) to the cacert.pem file.

Client certificate

PFM - Agent for Service Response sends a client certificate to the HTTP server. The HTTP server then verifies the validity period and confirms that the client certificate was issued from an authorized Certificate Authority. The client certificate and the private key can be obtained in either of the following ways.

The file containing the client certificate and private key must be stored under installation-folder\agtv\probe\cert. The file must be in Base64 encoded X.509 format. If the provided client certificate file is not in Base64 encoded X.509 format, use any tool to convert it to X.509 format.

The following shows how to export a client certificate and its private key by using Internet Explorer 8. Note that the client certificate to be exported must have been specified to allow export of the private key when they were imported to Internet Explorer.

  1. Start Internet Explorer, and select Tools, and then Internet Options.
    The Internet Options dialog box opens.
  2. Select the Contents tab, and then click the Certificates button.
    The Certificates dialog box opens.
  3. Select the Personal tab.
    The Personal page is displayed.
  4. Select the client certificate to be exported, and then click Export.
    The certificate export wizard starts. Export the certificate as instructed by the wizard.
    For Export Private Key, select Yes, export the private key.
    For the export file format, select Personal Information Exchange-PKCS#12(PFX).
    Clear the Enable strong protection check box.
    Enter any values for the password and file name.
  5. Convert the certificate format from PKCS#12 to Base64-encoded X.509.
    You can use any tool for conversion.
  6. Store the exported file under installation-folder\agtv\probe\cert.

RFC compliance

For the functions that are not compliance with RFCs and the restrictions, see the above notes.