SSL verification error during the execution of generated tests

[Na-na13]

Hi!

I’ve been experimenting on EvoMaster in blackbox mode. The test generation worked as expected, resulting in several executable test cases, but when trying to execute those tests, SSL verification error is raised, likely due to the use of HTTPS. EvoMaster is run with following command line options:

java -jar evomaster.jar
--blackBox true
--bbSwaggerUrl "file://$(pwd)/db/mysql/config/oauth2-${service}/openapi.yaml"
--bbTargetUrl "https://localhost:${port}"
--outputFolder "${service_output_directory}"
--maxTime 30s
--ratePerMinute 60

From what I understand, this issue can be bypassed by adding the keyword argument ‘verification=false’ to the requests calls in test cases. Is there a way to configure EvoMaster so that the generated tests automatically include this argument? (N.B. The target system does not accept the use of HTTP.)

[arcuri82]

hi @Na-na13 ,

thanks for reporting this issue.
Indeed, during the fuzzing, EvoMaster ignores certificates (due to several reasons...). But this behavior is not then enforced in the generated tests, as you pointed out.
We would need to fix it.

[arcuri82]

this seems related to #1071.
I would need to investigate bit more how EM behaves when dealing with https://localhost