SSL/TLS on Grafana Labs

Online Certificate Status Protocol (OCSP)

Mon, 21 Sep 2026 15:16:28 +0000

What is OCSP?

The Online Certificate Status Protocol (OCSP) lets web browsers and clients check the status of an issued TLS certificate with a Certificate Authority (CA), ensuring that the certificate has not been revoked.

It exists different ways to check whether the certificate has been revoked. Each way places the burden on different parties:

The browser/client: talk to the CA (or through a CA–entrusted OCSP responder) with OCSP. One downside with this approach is that the CA’s servers need to be available.
The browser vendor: maintain an up-to-date list of certificate revocations by talking to the CAs (or through a CA–entrusted OCSP responder) and distributing this list to the browsers running on users’ machines.
The server side: the server handles the interaction with the CA (or through a CA–entrusted OCSP responder), caching the results of the periodic updates and including a “stapled response” (referred to as OCSP stapling) in the TLS connection setup with the browser/client.

OCSP with k6

k6 supports OCSP stapling. The application can receive and parse a stapled response as part of the TLS connection setup. The OCSP response information is available in the ocsp.stapled_response property of the response object.

import http from 'k6/http';
import { check } from 'k6';

export default function () {
  const res = http.get('https://stackoverflow.com');
  check(res, {
    'is OCSP response good': (r) => r.ocsp.status === http.OCSP_STATUS_GOOD,
  });
}

Properties of an OCSP object

The OCSP ocsp object contains the following properties:

Key	Type	Description
`status`	string	the status of the certificate, see possible values below
`revocation_reason`	string	the reason for revocation of the certificate (if that is the status), see possible values below
`produced_at`	number	number of milliseconds elapsed since 1 January 1970 00:00:00 UTC, representing the time when this OCSP stapled response was signed by the CA (or CA–entrusted OCSP responder)
`this_update`	number	number of milliseconds elapsed since 1 January 1970 00:00:00 UTC, representing the time when the status being indicated was known to be correct
`next_update`	number	number of milliseconds elapsed since 1 January 1970 00:00:00 UTC, representing the time when this OCSP stapled response will be refreshed with CA (or by CA entrusted OCSP responder)
`revoked_at`	number	number of milliseconds elapsed since 1 January 1970 00:00:00 UTC, representing the time when this certificate was revoked (if that is the status)

Possible values for `status`:

http.OCSP_STATUS_GOOD
http.OCSP_STATUS_REVOKED
http.OCSP_STATUS_UNKNOWN
http.OCSP_STATUS_SERVER_FAILED

Possible values for `revocation_reason`:

http.OCSP_REASON_UNSPECIFIED
http.OCSP_REASON_KEY_COMPROMISE
http.OCSP_REASON_CA_COMPROMISE
http.OCSP_REASON_AFFILIATION_CHANGED
http.OCSP_REASON_SUPERSEDED
http.OCSP_REASON_CESSATION_OF_OPERATION
http.OCSP_REASON_CERTIFICATE_HOLD
http.OCSP_REASON_REMOVE_FROM_CRL
http.OCSP_REASON_PRIVILEGE_WITHDRAWN
http.OCSP_REASON_AA_COMPROMISE

SSL/TLS client certificates

Mon, 21 Sep 2026 15:16:28 +0000

SSL/TLS client certificates

Discussion about TLS certificates is usually about how clients authenticate servers. However, both TLS and k6 also support the reverse process, in which servers authenticate clients.

To use client certificates, specify global configuration options that tell k6 how to map a public certificate and private key to the domains they are valid for. You can load the certificate and key from local files or embed them as strings in the script.

Loading a certificate and a key from local files

To load a certificate and a key from local files, use the builtin open(...) function:

import http from 'k6/http';

export const options = {
  tlsAuth: [
    {
      domains: ['example.com'],
      cert: open('./mycert.pem'),
      key: open('./mycert-key.pem'),
    },
  ],
};

export default function () {
  http.get('https://example.com/');
}

Loading certificate and key from embedded strings

To load the certificate and key from embedded strings, use this snippet. Note the use of template literals for multi-line strings):

Note
These are just example keys.

import http from 'k6/http';

const CERT = `-----BEGIN CERTIFICATE-----
MIIFgTCCA2kCAQEwDQYJKoZIhvcNAQEFBQAwgYExCzAJBgNVBAYTAlNFMRcwFQYD
VQQIEw5TdG9ja2hvbG1zIExhbjESMBAGA1UEBxMJU3RvY2tob2xtMRcwFQYDVQQK
...
/n5QrTGhP51P9Q1THzRfn6cNCDwzSTMVEJr40QhuTJQWASe3miuFmZoG5ykmGqVm
fWQRiQyM330s9vTwFy14J2Bxe4px6cyy7rVXvYL2LvfA4L0T7/x1nUULw+Mpqun1
R3XRJWqGDjBKXr5q8VatdQO1QLgr
-----END CERTIFICATE-----`;

const KEY = `-----BEGIN RSA PRIVATE KEY-----
KsZVVI1FTX+F959vqu1S02T+R1JM29PkIfJILIXapKQfb0FWrALU5xpipdPYBWp7
j5iSp06/7H8ms87Uz9BrOA6rytoRSE0/wEe5WkWdBBgLLPpfOSWZsAA5RGCB2n+N
...
Dk+frzKuiErHFN7HOHAQannui4eLsY0ehYMByowgJIUGzIJyXR6O19hVhV7Py66u
X7/Jy01JXn83LuWdpaPAKU+B42BLP0IGXt5CocPms07HOdtJ/wm2zwHTyfjn9vu+
HO/dQr6a7DhRu2lLI9Sc983NwRqDKICZQQ/+gqWk8BgQZ1yI9O4AYkzywzAEk3py
-----END RSA PRIVATE KEY-----`;

export const options = {
  tlsAuth: [
    {
      domains: ['example.com'],
      cert: CERT,
      key: KEY,
    },
  ],
};

export default function () {
  http.get('https://example.com/');
}

SSL/TLS version and ciphers

Mon, 21 Sep 2026 15:16:28 +0000

SSL/TLS version and ciphers

To support testing specific client configurations, you can specify a version or range of versions of SSL/TLS that are allowed for a connection. You can as also specify which cipher suites are allowed for that connection.

⚠️ Reg. ciphers and TLS 1.3

Due to limitations in the underlying go implementation, changing the ciphers for TLS 1.3 is not supported and will do nothing.

Limiting SSL/TLS version

To limit the k6 to a specific SSL/TLS version, use a global configuration option:

import http from 'k6/http';

export const options = {
  tlsVersion: http.TLS_1_2,
};

export default function () {
  http.get('https://badssl.com');
}

You can also accept a range of SSL/TLS versions:

import http from 'k6/http';

export const options = {
  tlsVersion: {
    min: http.SSL_3_0,
    max: http.TLS_1_2,
  },
};

export default function () {
  http.get('https://badssl.com');
}

Versions available to choose from

Here’s the list of available SSL/TLS versions that you can choose from, ordered from oldest version to latest.

http.SSL_3_0
http.TLS_1_0
http.TLS_1_1
http.TLS_1_2
http.TLS_1_3

Limiting cipher suites

To limit the cipher suites that k6 is allowed to use, there’s a global configuration option. You choose a list of allowed ciphers:

import http from 'k6/http';

export const options = {
  tlsCipherSuites: ['TLS_RSA_WITH_RC4_128_SHA', 'TLS_RSA_WITH_AES_128_GCM_SHA256'],
};

export default function () {
  http.get('https://badssl.com');
}

Checking SSL/TLS version and cipher suite used in requests

You can also check which SSL/TLS version and ciphers were used. To do so, look at the tls_version and tls_cipher_suite response object properties.

import http from 'k6/http';
import { check } from 'k6';

export default function () {
  const res = http.get('https://sha256.badssl.com');
  check(res, {
    'is TLSv1.2': (r) => r.tls_version === http.TLS_1_2,
    'is sha256 cipher suite': (r) => r.tls_cipher_suite === 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',
  });
}

Cipher suites available to choose from

Here’s a list of available SSL/TLS cipher suites:

TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

⚠️ Differences depending on k6 build

This list reflects the available cipher suites in the latest official build. If you are using a custom-built k6, the available cipher suites will depend on the Go version you compiled it with, see https://golang.org/pkg/crypto/tls/#pkg-constants.

SSL/TLS on Grafana Labs

Online Certificate Status Protocol (OCSP)

What is OCSP?

OCSP with k6

Properties of an OCSP object

Possible values for status:

Possible values for revocation_reason:

SSL/TLS client certificates

SSL/TLS client certificates

Loading a certificate and a key from local files

Loading certificate and key from embedded strings

SSL/TLS version and ciphers

SSL/TLS version and ciphers

⚠️ Reg. ciphers and TLS 1.3

Limiting SSL/TLS version

Versions available to choose from

Limiting cipher suites

Checking SSL/TLS version and cipher suite used in requests

Cipher suites available to choose from

⚠️ Differences depending on k6 build

Possible values for `status`:

Possible values for `revocation_reason`: