I believe as a starting point for this issue, it is enough to

• Add a field related to TLS handshake at ClientConnectionTimingsBuilder
  • We can worry about generalizing and creating a common interface with server-side separately
  • Although we eventually want to offer more visibility to protocol upgrade timings, TLS timings should provide enough value for this iteration.

I think we can add fields to ClientConnectionTimingsBuilder like the following:

private long tlsHandshakeStartTimeMicros;
private long tlsHandshakeStartNanos;
private long tlsHandshakeEndNanos;
private boolean tlsHandshakeEndSet;

Afterwards, we can mark the above fields whenever a TLS handshake is started or completed.

A simple walkthrough of the process of establishing the connection is as follows:

1. The internal class which starts a client request execution is the following location:

• armeria/core/src/main/java/com/linecorp/armeria/client/HttpClientDelegate.java

  Line 63 in e1d1377

  public HttpResponse execute(ClientRequestContext ctx, HttpRequest req) throws Exception {

2. If we don't have a readily available connection, a new connection is attempted at the following location:

• armeria/core/src/main/java/com/linecorp/armeria/client/HttpChannelPool.java

  Line 409 in e1d1377

  channel.connect(remoteAddress, connectionPromise);

3. After Bootstrap#connect is called, the call will go through the netty pipeline and eventually HttpClientPipelineConfigurator#connect will be called.

• armeria/core/src/main/java/com/linecorp/armeria/client/HttpClientPipelineConfigurator.java

  Lines 179 to 180 in e1d1377

  	public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress,
  	ChannelPromise connectionPromise) throws Exception {

4. Lastly, we can notice we receive a callback on TLS handshake completion

• armeria/core/src/main/java/com/linecorp/armeria/client/HttpClientPipelineConfigurator.java

  Line 232 in e1d1377

  p.addLast(new ChannelInboundHandlerAdapter() {

• Note that SslHandler also provides a handshakeFuture method. We may want to check which approach is more straightforward to use.
  • https://github.com/netty/netty/blob/ffdb7c73de6383840a1ecd4507d7854538b5151d/handler/src/main/java/io/netty/handler/ssl/SslHandler.java#L623

In order to pass around the ClientConnectionTimingsBuilder, using attributes and attaching them to the channel is probably the easiest approach.

static final AttributeKey<ClientConnectionTimingsBuilder> TIMINGS_BUILDER_KEY =
        AttributeKey.valueOf(HttpChannelPool.class, "TIMINGS_BUILDER_KEY");
...
// set the ClientConnectionTimingsBuilder to the channel
channel.attr(TIMINGS_BUILDER_KEY).set(timingsBuilder);

// later retrieve the builder
final ClientConnectionTimingsBuilder timingsBuilder =
        ctx.channel().attr(TIMINGS_BUILDER_KEY).get();
timingsBuilder.tlsHandshakeStart();
...

Lastly, we will want to expose the new field at ClientConnectionTimings.

Misc
One point that may not be obvious that if a HTTP2 preface upgrade is attempted and failed, armeria retries the request with HTTP1. We probably want to transfer over the ClientConnectionTimingsBuilder in this case. The handling logic is at the following location:

• armeria/core/src/main/java/com/linecorp/armeria/client/HttpSessionHandler.java

  Lines 520 to 529 in e1d1377

  	assert responseDecoder == null || !responseDecoder.hasUnfinishedResponses();
  	if (sessionTimeoutFuture != null) {
  	sessionTimeoutFuture.cancel(false);
  	}
  	if (proxyDestinationAddress != null) {
  	channelPool.connect(proxyDestinationAddress, retryProtocol, serializationFormat,
  	poolKey, sessionPromise);
  	} else {
  	channelPool.connect(remoteAddress, retryProtocol, serializationFormat, poolKey, sessionPromise);
  	}

Also, this means that TLS may be attempted two times. I think it's fine to just record the last attempt for now (So if two attempts are made, we just overwrite the first attempt).

In terms of starting point, one can probably write a simple test which spins up a server, and a client makes a request via tls.

@RegisterExtension
static ServerExtension server = new ServerExtension() {
    @Override
    protected void configure(ServerBuilder sb) throws Exception {
        sb.https(0);
        sb.tlsSelfSigned();
        sb.service("/", (ctx, req) -> HttpResponse.of(200));
    }
};

@Test
void testTlsSelfSigned() {
    try (ClientFactory clientFactory =
                 ClientFactory.builder()
                              .tlsNoVerify()
                              .build()) {
        final AggregatedHttpResponse res =
                server.blockingWebClient(cb -> cb.factory(clientFactory))
                      .get("/");
        assertThat(res.status().code()).isEqualTo(200);
    }
}

reserved for @Leewongi0731

Thanks. I'll try to resolve this issue!!