A Trusted JMeter Recorder Still Needs an mTLS Client Key

Installing JMeter's recording CA in the browser solves one direction of trust: the browser can accept the recorder's replacement website certificates. It gives JMeter no client private key for the application's mTLS handshake.

browser → JMeter recorder → mTLS application
          records HTTPS    presents client identity

In an intercepted recording, JMeter makes that onward HTTPS connection. Select the authorized client certificate and matching private key from a JKS or PKCS12 keystore through Options → SSL Manager, or the documented JVM keystore configuration. Account for the HTTP implementation and alias selection used by the test. A public CA certificate alone cannot supply that identity.

Diagnose the exchange in order: browser trust in the recorder, any corporate proxy connection and authentication, then the destination TLS handshake. A 407 belongs to the proxy login; changing the mTLS certificate cannot answer it.

Recorded request data does not carry the private-key identity into a later replay. The replay's outbound client also needs a working identity configuration. If that replay receives a proxy 407, configure JMeter's outbound proxy credentials separately.