diff --git a/bin/jmeter.properties b/bin/jmeter.properties
index dd4dd7eaacd..03d215c40ce 100644
--- a/bin/jmeter.properties
+++ b/bin/jmeter.properties
@@ -378,8 +378,92 @@ remote_hosts=127.0.0.1
 #httpclient.timeout=0
 # 0 == no timeout
 
-# Set the http version (defaults to 1.1)
-#httpclient.version=1.1 (or use the parameter http.protocol.version)
+# Set the default HTTP version for HttpClient5 and Java samplers when HTTP Version is empty
+# Valid values are HTTP/1.1, HTTP/2 and, for HttpClient5 only, HTTP/2 Strict (defaults to HTTP/1.1)
+#httpclient.version=HTTP/1.1
+
+# Milliseconds of inactivity after which a pooled connection of the HttpClient5
+# sampler implementation is re-validated before it is reused (HTTP/2 PING, or a
+# stale check for HTTP/1.1), -1 disables the check. Without it a connection the
+# server closed while the thread was idle is reused as it is and fails the
+# sample, as JMeter deliberately does not retry requests
+#httpclient5.validate_after_inactivity=2000
+
+# HTTP/2 settings used by the HttpClient5 sampler implementation
+
+# Multiplex concurrent message exchanges (e.g. parallel downloads of embedded
+# resources) over a single HTTP/2 connection
+#httpclient5.h2.multiplexing=true
+
+# Maximum number of HTTP/2 connections kept per target host. With multiplexing
+# enabled a single connection usually serves all concurrent requests
+#httpclient5.h2.max_connections_per_route=6
+
+# Size in bytes of the HPACK dynamic header table announced to the server.
+# 0 disables indexing of headers by the server
+#httpclient5.h2.header_table_size=8192
+
+# Compress the request headers with HPACK
+#httpclient5.h2.header_compression=true
+
+# Maximum number of concurrent streams the client accepts on a connection
+#httpclient5.h2.max_concurrent_streams=250
+
+# Flow control window in bytes announced per stream
+#httpclient5.h2.initial_window_size=65535
+
+# Largest frame payload in bytes the client is willing to receive
+#httpclient5.h2.max_frame_size=65536
+
+# Accept server push. JMeter cannot report pushed resources, so they are
+# dropped, therefore push is disabled by default
+#httpclient5.h2.push_enabled=false
+
+# Use HTTP/2 over cleartext (h2c, prior knowledge) when HTTP/2 is selected for
+# a http:// URL. Without it such requests fall back to HTTP/1.1, because
+# protocol negotiation requires TLS. Only enable it if all plain HTTP targets
+# support h2c
+#httpclient5.h2.prior_knowledge=false
+
+# HTTP/2 settings used by the Java sampler implementation. Except for the
+# multiplexing they are applied as jdk.httpclient.* system properties, so a
+# setting given on the command line always takes precedence
+
+# Multiplex concurrent message exchanges (e.g. requests of different threads or
+# parallel downloads of embedded resources) over a single HTTP/2 connection.
+# Requests which start before the first HTTP/2 connection to a host has been
+# established still open a connection of their own
+#http.java.h2.multiplexing=true
+
+# Size in bytes of the HPACK dynamic header table announced to the server.
+# 0 disables indexing of headers by the server (JDK default: 16384)
+#http.java.h2.header_table_size=16384
+
+# Maximum number of server initiated (pushed) streams the client accepts on a
+# connection (JDK default: 100 with server push enabled, 0 otherwise)
+#http.java.h2.max_concurrent_streams=100
+
+# Flow control window in bytes announced per stream (JDK default: 16777216)
+#http.java.h2.initial_window_size=16777216
+
+# Flow control window in bytes announced for the whole connection, it must not
+# be smaller than the stream window (JDK default: 67108864)
+#http.java.h2.connection_window_size=67108864
+
+# Largest frame payload in bytes the client is willing to receive, between
+# 16384 and 16777215 (JDK default: 16384)
+#http.java.h2.max_frame_size=16384
+
+# Seconds an idle HTTP/2 connection is kept in the pool (JDK default: the value
+# of jdk.httpclient.keepalive.timeout, which defaults to 30)
+#http.java.h2.keep_alive_timeout=30
+
+# Accept server push. JMeter cannot report pushed resources, so they are
+# dropped, therefore push is disabled by default
+#http.java.h2.push_enabled=false
+
+# If true, default HC5 User-Agent will not be added
+#httpclient5.default_user_agent_disabled=false
 
 # Define characters per second > 0 to emulate slow connections
 #httpclient.socket.http.cps=0
diff --git a/src/bom-thirdparty/build.gradle.kts b/src/bom-thirdparty/build.gradle.kts
index ffd0b4073f5..62bca7e461c 100644
--- a/src/bom-thirdparty/build.gradle.kts
+++ b/src/bom-thirdparty/build.gradle.kts
@@ -106,7 +106,9 @@ dependencies {
         api("org.apache.commons:commons-text:1.14.0") {
             because("User might still rely on commons-text")
         }
-        api("org.apache.httpcomponents.client5:httpclient5:5.5.1")
+        api("org.apache.httpcomponents.client5:httpclient5:5.6.4")
+        api("org.apache.httpcomponents.core5:httpcore5:5.4.3")
+        api("org.apache.httpcomponents.core5:httpcore5-h2:5.4.3")
         api("org.apache.httpcomponents:httpasyncclient:4.1.5")
         api("org.apache.httpcomponents:httpclient:4.5.14")
         api("org.apache.httpcomponents:httpcore-nio:4.4.16")
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages.properties
index 3137d879e74..3ba59ea9f1f 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages.properties
@@ -473,6 +473,7 @@ html_assertion_title=HTML Assertion
 html_extractor_title=CSS Selector Extractor
 html_extractor_type=CSS Selector Extractor Implementation
 http_implementation=Implementation:
+http_version=HTTP Version:
 html_report=Generate HTML report
 http_response_code=HTTP response code
 http_url_rewriting_modifier_title=HTTP URL Re-writing Modifier
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_de.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_de.properties
index f1278670119..17ff43ab91f 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_de.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_de.properties
@@ -16,6 +16,7 @@
 #
 
 about=Über Apache JMeter
+http_version=HTTP-Version\:
 add=Hinzufügen
 add_as_child=Als ein Kind hinzufügen
 add_parameter=Variable hinzufügen
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_es.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_es.properties
index 8fe4fb5a53d..dcb50db6a35 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_es.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_es.properties
@@ -273,6 +273,7 @@ html_assertion_file=Escribir el reporte JTidy en fichero
 html_assertion_label=Aserción HTML
 html_assertion_title=Aserción HTML
 http_implementation=Implementación HTTP\:
+http_version=Versión HTTP\:
 http_response_code=código de respuesta HTTP
 http_url_rewriting_modifier_title=Modificador de re-escritura HTTP URL
 http_user_parameter_modifier=Modificador de Parámetro de Usuario HTTP
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_fr.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_fr.properties
index 044d7ba8351..209f0a84645 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_fr.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_fr.properties
@@ -467,6 +467,7 @@ html_assertion_title=Assertion HTML
 html_extractor_title=Extracteur par  Sélecteur CSS
 html_extractor_type=Implémentation de l'extracteur Sélecteur CSS
 http_implementation=Implémentation \:
+http_version=Version HTTP \:
 html_report=Générer le rapport HTML
 http_response_code=Code de réponse HTTP
 http_url_rewriting_modifier_title=Transcripteur d'URL HTTP
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_ja.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_ja.properties
index 561489d9e29..6fe16f42798 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_ja.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_ja.properties
@@ -176,6 +176,7 @@ grouping_store_first_only=各グループの最初のサンプラーだけ保存
 header_manager_title=HTTP ヘッダマネージャ
 headers_stored=ヘッダーマネージャに保存されているヘッダ
 help=ヘルプ
+http_version=HTTP バージョン\:
 http_response_code=HTTP応答コード
 http_url_rewriting_modifier_title=HTTP URL-Rewriting 修飾子
 http_user_parameter_modifier=HTTPユーザーパラメータの変更
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_ko.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_ko.properties
index 8b963980d24..1de63f00cd6 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_ko.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_ko.properties
@@ -471,6 +471,7 @@ html_assertion_title=HTML Assertion
 html_extractor_title=CSS Selector 추출기
 html_extractor_type=CSS Selector 추출기 구현
 http_implementation=구현\:
+http_version=HTTP 버전\:
 html_report=HTML 보고서 생성
 http_response_code=HTTP 응답 코드
 http_url_rewriting_modifier_title=HTTP URL Re-writing Modifier
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_no.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_no.properties
index a6daacc3059..160b0288aa1 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_no.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_no.properties
@@ -71,6 +71,7 @@ graph_results_deviation=Avvik
 graph_results_title=Graf resultater
 headers_stored=Headere lagret hos headermanager
 help=Hjelp
+http_version=HTTP-versjon\:
 infinite=Uendelig
 interleave_control_title=Vekslende kontroller
 iterator_num=Løkketeller\:
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_pl.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_pl.properties
index fb5aedd2f24..9d81a10d112 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_pl.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_pl.properties
@@ -16,6 +16,7 @@
 #
 
 about=O programie Apache JMeter
+http_version=Wersja HTTP\:
 action_check_message=Aktualnie jest przeprowadzany test, zatrzymaj albo wyłącz test, aby uruchomić to polecenie
 action_check_title=Test uruchomiony
 active_total_threads_tooltip=Uruchamianie wątków / całkowita liczba wątków do uruchomienia
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_pt_BR.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_pt_BR.properties
index e9960bf8719..e278975db23 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_pt_BR.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_pt_BR.properties
@@ -261,6 +261,7 @@ html_assertion_file=Escrever relatório do JTidy em arquivo
 html_assertion_label=Asserção HTML
 html_assertion_title=Asserção HTML
 http_implementation=Implementação\:
+http_version=Versão HTTP\:
 http_response_code=Código da Resposta HTTP
 http_url_rewriting_modifier_title=Modificador de Re-escrita de URL HTTP
 http_user_parameter_modifier=Modificador de Parâmetros HTTP do Usuário
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_tr.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_tr.properties
index 352f8bd7e7a..a18b1fffbf4 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_tr.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_tr.properties
@@ -246,6 +246,7 @@ html_assertion_file=JTidy raporunu dosyaya yaz
 html_assertion_label=HTML Doğrulama
 html_assertion_title=HTML Doğrulama
 http_implementation=Uygulaması\:
+http_version=HTTP sürümü\:
 http_response_code=HTTP cevap kodu
 http_url_rewriting_modifier_title=HTTP URL Yeniden Yazma Niteleyicisi
 http_user_parameter_modifier=HTTP Kullanıcı Parametresi Niteleyicisi
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_zh_CN.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_zh_CN.properties
index 1763f2be645..253e35f83ed 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_zh_CN.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_zh_CN.properties
@@ -433,6 +433,7 @@ html_assertion_title=HTML断言
 html_extractor_title=CSS/JQuery提取器
 html_extractor_type=CSS 选择器提取器实现
 http_implementation=实现：
+http_version=HTTP 版本：
 http_response_code=HTTP响应代码
 http_url_rewriting_modifier_title=HTTP URL 重写修饰符
 http_user_parameter_modifier=HTTP 用户参数修饰符
diff --git a/src/core/src/main/resources/org/apache/jmeter/resources/messages_zh_TW.properties b/src/core/src/main/resources/org/apache/jmeter/resources/messages_zh_TW.properties
index 93107f3298c..49012192320 100644
--- a/src/core/src/main/resources/org/apache/jmeter/resources/messages_zh_TW.properties
+++ b/src/core/src/main/resources/org/apache/jmeter/resources/messages_zh_TW.properties
@@ -206,6 +206,7 @@ headers_stored=標頭管理員中儲存的標頭資料
 help=輔助說明
 html_assertion_label=HTML 驗證
 html_assertion_title=HTML 驗證
+http_version=HTTP 版本：
 http_response_code=HTTP 回應代碼
 http_url_rewriting_modifier_title=HTTP URL 重導修飾詞
 http_user_parameter_modifier=HTTP 使用者參數修飾詞
diff --git a/src/dist-check/src/test/java/org/apache/jmeter/junit/JMeterTest.java b/src/dist-check/src/test/java/org/apache/jmeter/junit/JMeterTest.java
index 2aca34f3e1e..0aff1b1a678 100644
--- a/src/dist-check/src/test/java/org/apache/jmeter/junit/JMeterTest.java
+++ b/src/dist-check/src/test/java/org/apache/jmeter/junit/JMeterTest.java
@@ -385,6 +385,7 @@ public void GUIComponents2(GuiComponentHolder componentHolder) throws Exception
         // TODO: support expressions?
         IGNORED_PROPERTIES.add(HTTPSamplerBaseSchema.INSTANCE.getIpSourceType());
         IGNORED_PROPERTIES.add(HTTPSamplerBaseSchema.INSTANCE.getImplementation());
+        IGNORED_PROPERTIES.add(HTTPSamplerBaseSchema.INSTANCE.getHttpVersion());
         // TODO: support expressions in UrlConfigGui
         IGNORED_PROPERTIES.add(HTTPSamplerBaseSchema.INSTANCE.getFollowRedirects());
         IGNORED_PROPERTIES.add(HTTPSamplerBaseSchema.INSTANCE.getAutoRedirects());
diff --git a/src/protocol/http/build.gradle.kts b/src/protocol/http/build.gradle.kts
index af6b3482f5d..d8d5c20017e 100644
--- a/src/protocol/http/build.gradle.kts
+++ b/src/protocol/http/build.gradle.kts
@@ -61,6 +61,11 @@ dependencies {
         exclude("com.google.code.findbugs", "jsr305")
     }
     implementation("dnsjava:dnsjava")
+    implementation("org.apache.httpcomponents.client5:httpclient5")
+    implementation("org.apache.httpcomponents.core5:httpcore5")
+    implementation("org.apache.httpcomponents.core5:httpcore5-h2") {
+        because("HTTPHC5Impl uses H2Config and HttpVersionPolicy from org.apache.hc.core5.http2")
+    }
     implementation("org.apache.httpcomponents:httpmime")
     implementation("org.apache.httpcomponents:httpcore")
     implementation("org.brotli:dec")
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/config/gui/HttpDefaultsGui.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/config/gui/HttpDefaultsGui.java
index 8b49bcbb4ec..71bf2ca5e2a 100644
--- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/config/gui/HttpDefaultsGui.java
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/config/gui/HttpDefaultsGui.java
@@ -37,6 +37,7 @@
 import org.apache.jmeter.gui.TestElementMetadata;
 import org.apache.jmeter.gui.util.HorizontalPanel;
 import org.apache.jmeter.gui.util.VerticalPanel;
+import org.apache.jmeter.protocol.http.gui.HttpVersionComboBox;
 import org.apache.jmeter.protocol.http.sampler.HTTPSamplerBase;
 import org.apache.jmeter.protocol.http.sampler.HTTPSamplerBaseSchema;
 import org.apache.jmeter.protocol.http.sampler.HTTPSamplerFactory;
@@ -79,6 +80,7 @@ public class HttpDefaultsGui extends AbstractConfigGui {
     private JTextField proxyUser;
     private JPasswordField proxyPass;
     private final JComboBox<String> httpImplementation = new JComboBox<>(HTTPSamplerFactory.getImplementations());
+    private final HttpVersionComboBox httpVersion = new HttpVersionComboBox();
     private JTextField connectTimeOut;
     private JTextField responseTimeOut;
 
@@ -152,6 +154,7 @@ public void modifyTestElement(TestElement config) {
         }
 
         config.set(httpSchema.getImplementation(), String.valueOf(httpImplementation.getSelectedItem()));
+        config.set(httpSchema.getHttpVersion(), String.valueOf(httpVersion.getSelectedItem()));
     }
 
     @Override
@@ -169,6 +172,8 @@ public void configure(TestElement el) {
         HTTPSamplerBaseSchema httpSchema = HTTPSamplerBaseSchema.INSTANCE;
         sourceIpType.setSelectedIndex(samplerBase.get(httpSchema.getIpSourceType()));
         httpImplementation.setSelectedItem(samplerBase.getString(httpSchema.getImplementation()));
+        httpVersion.setImplementation(samplerBase.getString(httpSchema.getImplementation()));
+        httpVersion.setSelectedItem(samplerBase.getString(httpSchema.getHttpVersion()));
     }
 
     private void init() { // WARNING: called from ctor so must not be overridden (i.e. must be private or final)
@@ -329,6 +334,9 @@ protected final JPanel getImplementationPanel(){
         implPanel.add(new JLabel(JMeterUtils.getResString("http_implementation"))); // $NON-NLS-1$
         httpImplementation.addItem("");// $NON-NLS-1$
         implPanel.add(httpImplementation);
+        implPanel.add(new JLabel(JMeterUtils.getResString("http_version"))); // $NON-NLS-1$
+        httpVersion.bindToImplementation(httpImplementation);
+        implPanel.add(httpVersion);
         return implPanel;
     }
 
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/CacheManager.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/CacheManager.java
index 8852f6332e4..32509ab81f8 100644
--- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/CacheManager.java
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/CacheManager.java
@@ -245,6 +245,55 @@ public void saveDetails(HttpResponse method, HTTPSampleResult res) {
         }
     }
 
+    /**
+     * Save the Last-Modified, Etag, and Expires headers if the result is
+     * cacheable. Version for Apache HttpClient 5 implementation.
+     *
+     * @param response response to extract header information from
+     * @param res result to decide if result is cacheable
+     */
+    public void saveDetails(org.apache.hc.core5.http.ClassicHttpResponse response, HTTPSampleResult res) {
+        final String varyHeader = getHeader(response, HTTPConstants.VARY);
+        if (isCacheable(res, varyHeader)) {
+            String lastModified = getHeader(response, HTTPConstants.LAST_MODIFIED);
+            String expires = getHeader(response, HTTPConstants.EXPIRES);
+            String etag = getHeader(response, HTTPConstants.ETAG);
+            String cacheControl = getHeader(response, HTTPConstants.CACHE_CONTROL);
+            String date = getHeader(response, HTTPConstants.DATE);
+            if (anyNotBlank(lastModified, expires, etag, cacheControl)) {
+                setCache(lastModified, cacheControl, expires, etag,
+                        res.getUrlAsString(), date, getVaryHeader(varyHeader, asHeaders(res.getRequestHeaders())));
+            }
+        }
+    }
+
+    /**
+     * Save the Last-Modified, Etag, and Expires headers if the result is
+     * cacheable. Version for Java HttpClient implementation.
+     *
+     * @param response response to extract header information from
+     * @param res result to decide if result is cacheable
+     */
+    public void saveDetails(java.net.http.HttpResponse<?> response, HTTPSampleResult res) {
+        final String varyHeader = response.headers().firstValue(HTTPConstants.VARY).orElse(null);
+        if (isCacheable(res, varyHeader)) {
+            String lastModified = response.headers().firstValue(HTTPConstants.LAST_MODIFIED).orElse(null);
+            String expires = response.headers().firstValue(HTTPConstants.EXPIRES).orElse(null);
+            String etag = response.headers().firstValue(HTTPConstants.ETAG).orElse(null);
+            String cacheControl = response.headers().firstValue(HTTPConstants.CACHE_CONTROL).orElse(null);
+            String date = response.headers().firstValue(HTTPConstants.DATE).orElse(null);
+            if (anyNotBlank(lastModified, expires, etag, cacheControl)) {
+                setCache(lastModified, cacheControl, expires, etag,
+                        res.getUrlAsString(), date, getVaryHeader(varyHeader, asHeaders(res.getRequestHeaders())));
+            }
+        }
+    }
+
+    private static String getHeader(org.apache.hc.core5.http.HttpMessage message, String name) {
+        org.apache.hc.core5.http.Header header = message.getFirstHeader(name);
+        return header == null ? null : header.getValue();
+    }
+
     // helper method to save the cache entry
     private void setCache(String lastModified, String cacheControl, String expires,
             String etag, String url, String date, Map.Entry<String, String> varyHeader) {
@@ -410,6 +459,29 @@ public void setHeaders(URL url, HttpRequestBase request) {
         }
     }
 
+    /**
+     * Check the cache, and if there is a match, set conditional request headers.
+     *
+     * @param url URL to look up in cache
+     * @param request request where to set the headers
+     */
+    public void setHeaders(URL url, org.apache.hc.core5.http.ClassicHttpRequest request) {
+        CacheEntry entry = getEntry(url.toString(), asHeaders(request.getHeaders()));
+        if (log.isDebugEnabled()) {
+            log.debug("setHeaders for HTTP Method:{}(HC5) URL:{} Entry:{}", request.getMethod(), url, entry);
+        }
+        if (entry != null) {
+            String lastModified = entry.getLastModified();
+            if (lastModified != null) {
+                request.setHeader(HTTPConstants.IF_MODIFIED_SINCE, lastModified);
+            }
+            String etag = entry.getEtag();
+            if (etag != null) {
+                request.setHeader(HTTPConstants.IF_NONE_MATCH, etag);
+            }
+        }
+    }
+
     /**
      * Check the cache, and if there is a match, set the headers:
      * <ul>
@@ -460,6 +532,17 @@ public boolean inCache(URL url, Header[] allHeaders) {
         return entryStillValid(url, getEntry(url.toString(), allHeaders));
     }
 
+    /**
+     * Check whether the URL has a valid entry for the supplied HttpClient 5 request headers.
+     *
+     * @param url URL to look up in cache
+     * @param allHeaders request headers
+     * @return {@code true} if the matching entry has not expired
+     */
+    public boolean inCache(URL url, org.apache.hc.core5.http.Header[] allHeaders) {
+        return entryStillValid(url, getEntry(url.toString(), asHeaders(allHeaders)));
+    }
+
     public boolean inCache(URL url, org.apache.jmeter.protocol.http.control.Header[] allHeaders) {
         return entryStillValid(url, getEntry(url.toString(), asHeaders(allHeaders)));
     }
@@ -484,6 +567,14 @@ private static Header[] asHeaders(String allHeaders) {
         return result.toArray(new Header[result.size()]);
     }
 
+    private static Header[] asHeaders(org.apache.hc.core5.http.Header[] allHeaders) {
+        Header[] result = new Header[allHeaders.length];
+        for (int i = 0; i < allHeaders.length; i++) {
+            result[i] = new BasicHeader(allHeaders[i].getName(), allHeaders[i].getValue());
+        }
+        return result;
+    }
+
     private static class HeaderAdapter implements Header {
 
         private final org.apache.jmeter.protocol.http.control.Header delegate;
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/gui/HttpTestSampleGui.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/gui/HttpTestSampleGui.java
index 77863a286bd..95849db5c41 100644
--- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/gui/HttpTestSampleGui.java
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/gui/HttpTestSampleGui.java
@@ -37,6 +37,7 @@
 import org.apache.jmeter.gui.util.HorizontalPanel;
 import org.apache.jmeter.gui.util.VerticalPanel;
 import org.apache.jmeter.protocol.http.config.gui.UrlConfigGui;
+import org.apache.jmeter.protocol.http.gui.HttpVersionComboBox;
 import org.apache.jmeter.protocol.http.sampler.HTTPSamplerBase;
 import org.apache.jmeter.protocol.http.sampler.HTTPSamplerBaseSchema;
 import org.apache.jmeter.protocol.http.sampler.HTTPSamplerFactory;
@@ -81,6 +82,7 @@ public class HttpTestSampleGui extends AbstractSamplerGui {
     private JTextField proxyUser;
     private JPasswordField proxyPass;
     private final JComboBox<String> httpImplementation = new JComboBox<>(HTTPSamplerFactory.getImplementations());
+    private final HttpVersionComboBox httpVersion = new HttpVersionComboBox();
     private JTextField connectTimeOut;
     private JTextField responseTimeOut;
 
@@ -135,6 +137,8 @@ public void configure(TestElement element) {
         if (!isAJP) {
             sourceIpType.setSelectedIndex(samplerBase.getIpSourceType());
             httpImplementation.setSelectedItem(samplerBase.getString(httpSchema.getImplementation()));
+            httpVersion.setImplementation(samplerBase.getString(httpSchema.getImplementation()));
+            httpVersion.setSelectedItem(samplerBase.getHttpVersion());
         }
     }
 
@@ -179,6 +183,9 @@ public void modifyTestElement(TestElement sampler) {
             String selectedImplementation = String.valueOf(httpImplementation.getSelectedItem());
             samplerBase.set(httpSchema.getImplementation(),
                     StringUtilities.isBlank(selectedImplementation) ? null : selectedImplementation);
+            String selectedHttpVersion = String.valueOf(httpVersion.getSelectedItem());
+            samplerBase.set(httpSchema.getHttpVersion(),
+                    StringUtilities.isBlank(selectedHttpVersion) ? null : selectedHttpVersion);
         }
     }
 
@@ -349,6 +356,9 @@ protected final JPanel getImplementationPanel(){
         implPanel.add(new JLabel(JMeterUtils.getResString("http_implementation"))); // $NON-NLS-1$
         httpImplementation.addItem("");// $NON-NLS-1$
         implPanel.add(httpImplementation);
+        implPanel.add(new JLabel(JMeterUtils.getResString("http_version"))); // $NON-NLS-1$
+        httpVersion.bindToImplementation(httpImplementation);
+        implPanel.add(httpVersion);
         return implPanel;
     }
 
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/gui/HttpVersionComboBox.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/gui/HttpVersionComboBox.java
new file mode 100644
index 00000000000..c5800054748
--- /dev/null
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/gui/HttpVersionComboBox.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jmeter.protocol.http.gui;
+
+import java.awt.Component;
+import java.awt.event.ItemEvent;
+import java.util.Arrays;
+import java.util.Objects;
+
+import javax.swing.DefaultComboBoxModel;
+import javax.swing.DefaultListCellRenderer;
+import javax.swing.JComboBox;
+import javax.swing.JList;
+
+import org.apache.jmeter.protocol.http.sampler.HTTPSamplerFactory;
+import org.apache.jmeter.protocol.http.util.HTTPConstants;
+
+/**
+ * Combo box for the HTTP version of a sampler, offering only the versions the selected
+ * implementation supports. The items are the values stored in the {@code HTTPSampler.httpVersion}
+ * property, the rendering spells out how HTTP/2 is applied.
+ *
+ * @since 5.7
+ */
+public class HttpVersionComboBox extends JComboBox<String> {
+
+    private static final long serialVersionUID = 1L;
+
+    public HttpVersionComboBox() {
+        super(HTTPSamplerFactory.getHttpVersions(""));
+        setRenderer(new DefaultListCellRenderer() {
+            private static final long serialVersionUID = 1L;
+
+            @Override
+            public Component getListCellRendererComponent(JList<?> list, Object value, int index,
+                    boolean isSelected, boolean cellHasFocus) {
+                return super.getListCellRendererComponent(list, getLabel(value), index, isSelected, cellHasFocus);
+            }
+        });
+    }
+
+    private static Object getLabel(Object value) {
+        if (HTTPConstants.HTTP_VERSION_2.equals(value)) {
+            // Spelled out, as HTTP/2 falls back to HTTP/1.1 when the server does not support it
+            return "HTTP/2 Negotiate";
+        }
+        return value;
+    }
+
+    /**
+     * Keeps the offered HTTP versions in sync with the implementation selected in the given combo
+     * box, so combinations an implementation would ignore cannot be selected.
+     *
+     * @param httpImplementation combo box holding the implementation of the sampler
+     */
+    public void bindToImplementation(JComboBox<String> httpImplementation) {
+        httpImplementation.addItemListener(event -> {
+            if (event.getStateChange() == ItemEvent.SELECTED) {
+                setImplementation(Objects.toString(event.getItem(), ""));
+            }
+        });
+        setImplementation(Objects.toString(httpImplementation.getSelectedItem(), ""));
+    }
+
+    /**
+     * Restricts the offered HTTP versions to the ones the given implementation supports.
+     *
+     * @param implementation implementation name, an empty value refers to the default implementation
+     */
+    public void setImplementation(String implementation) {
+        String[] versions = HTTPSamplerFactory.getHttpVersions(implementation);
+        String selected = (String) getSelectedItem();
+        if (Arrays.equals(versions, getItems())) {
+            return;
+        }
+        setModel(new DefaultComboBoxModel<>(versions));
+        setSelectedItem(Arrays.asList(versions).contains(selected) ? selected : "");
+    }
+
+    private String[] getItems() {
+        String[] items = new String[getItemCount()];
+        Arrays.setAll(items, this::getItemAt);
+        return items;
+    }
+
+    /**
+     * {@inheritDoc}
+     * <p>
+     * A version which the selected implementation does not offer, e.g. one read from a test plan
+     * saved with an earlier version of JMeter, is added to the model instead of being dropped
+     * silently.
+     */
+    @Override
+    public void setSelectedItem(Object item) {
+        if (item instanceof String version && !Arrays.asList(getItems()).contains(version)
+                && getModel() instanceof DefaultComboBoxModel) {
+            ((DefaultComboBoxModel<String>) getModel()).addElement(version);
+        }
+        super.setSelectedItem(item);
+    }
+}
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPHC5Impl.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPHC5Impl.java
new file mode 100644
index 00000000000..b6052f223d4
--- /dev/null
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPHC5Impl.java
@@ -0,0 +1,1494 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jmeter.protocol.http.sampler;
+
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.net.InetAddress;
+import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URL;
+import java.net.URLDecoder;
+import java.net.UnknownHostException;
+import java.nio.charset.Charset;
+import java.security.GeneralSecurityException;
+import java.security.Principal;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+
+import javax.net.ssl.SSLContext;
+import javax.security.auth.Subject;
+
+import org.apache.hc.client5.http.DnsResolver;
+import org.apache.hc.client5.http.HttpRoute;
+import org.apache.hc.client5.http.SystemDefaultDnsResolver;
+import org.apache.hc.client5.http.async.methods.SimpleHttpRequest;
+import org.apache.hc.client5.http.async.methods.SimpleHttpResponse;
+import org.apache.hc.client5.http.auth.AuthSchemeFactory;
+import org.apache.hc.client5.http.auth.AuthScope;
+import org.apache.hc.client5.http.auth.Credentials;
+import org.apache.hc.client5.http.auth.CredentialsProvider;
+import org.apache.hc.client5.http.auth.KerberosConfig;
+import org.apache.hc.client5.http.auth.KerberosCredentials;
+import org.apache.hc.client5.http.auth.StandardAuthScheme;
+import org.apache.hc.client5.http.auth.UsernamePasswordCredentials;
+import org.apache.hc.client5.http.classic.ExecChainHandler;
+import org.apache.hc.client5.http.config.ConnectionConfig;
+import org.apache.hc.client5.http.config.RequestConfig;
+import org.apache.hc.client5.http.config.TlsConfig;
+import org.apache.hc.client5.http.entity.DecompressingEntity;
+import org.apache.hc.client5.http.entity.DeflateInputStreamFactory;
+import org.apache.hc.client5.http.entity.GZIPInputStreamFactory;
+import org.apache.hc.client5.http.entity.InputStreamFactory;
+import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
+import org.apache.hc.client5.http.entity.mime.MultipartEntityBuilder;
+import org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient;
+import org.apache.hc.client5.http.impl.async.HttpAsyncClientBuilder;
+import org.apache.hc.client5.http.impl.async.HttpAsyncClients;
+import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
+import org.apache.hc.client5.http.impl.auth.BasicSchemeFactory;
+import org.apache.hc.client5.http.impl.auth.BearerSchemeFactory;
+import org.apache.hc.client5.http.impl.auth.DigestSchemeFactory;
+import org.apache.hc.client5.http.impl.auth.KerberosSchemeFactory;
+import org.apache.hc.client5.http.impl.auth.SPNegoSchemeFactory;
+import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.client5.http.impl.classic.HttpClients;
+import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
+import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManagerBuilder;
+import org.apache.hc.client5.http.impl.routing.DefaultRoutePlanner;
+import org.apache.hc.client5.http.io.ConnectionEndpoint;
+import org.apache.hc.client5.http.io.HttpClientConnectionManager;
+import org.apache.hc.client5.http.io.LeaseRequest;
+import org.apache.hc.client5.http.nio.AsyncClientConnectionManager;
+import org.apache.hc.client5.http.nio.AsyncConnectionEndpoint;
+import org.apache.hc.client5.http.protocol.HttpClientContext;
+import org.apache.hc.client5.http.ssl.ClientTlsStrategyBuilder;
+import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy;
+import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
+import org.apache.hc.client5.http.ssl.TrustAllStrategy;
+import org.apache.hc.core5.concurrent.FutureCallback;
+import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.Header;
+import org.apache.hc.core5.http.HeaderElement;
+import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.HttpHost;
+import org.apache.hc.core5.http.HttpRequestInterceptor;
+import org.apache.hc.core5.http.HttpVersion;
+import org.apache.hc.core5.http.NameValuePair;
+import org.apache.hc.core5.http.config.Lookup;
+import org.apache.hc.core5.http.config.RegistryBuilder;
+import org.apache.hc.core5.http.io.entity.ByteArrayEntity;
+import org.apache.hc.core5.http.io.entity.EntityUtils;
+import org.apache.hc.core5.http.io.entity.FileEntity;
+import org.apache.hc.core5.http.io.entity.StringEntity;
+import org.apache.hc.core5.http.message.BasicClassicHttpResponse;
+import org.apache.hc.core5.http.message.BasicHeaderValueParser;
+import org.apache.hc.core5.http.message.BasicNameValuePair;
+import org.apache.hc.core5.http.message.ParserCursor;
+import org.apache.hc.core5.http.nio.ssl.TlsStrategy;
+import org.apache.hc.core5.http.protocol.HttpContext;
+import org.apache.hc.core5.http2.HttpVersionPolicy;
+import org.apache.hc.core5.http2.config.H2Config;
+import org.apache.hc.core5.io.CloseMode;
+import org.apache.hc.core5.pool.PoolConcurrencyPolicy;
+import org.apache.hc.core5.reactor.ConnectionInitiator;
+import org.apache.hc.core5.ssl.SSLContexts;
+import org.apache.hc.core5.util.TimeValue;
+import org.apache.hc.core5.util.Timeout;
+import org.apache.hc.core5.util.VersionInfo;
+import org.apache.jmeter.protocol.http.control.AuthManager;
+import org.apache.jmeter.protocol.http.control.Authorization;
+import org.apache.jmeter.protocol.http.control.CacheManager;
+import org.apache.jmeter.protocol.http.control.CookieManager;
+import org.apache.jmeter.protocol.http.control.DNSCacheManager;
+import org.apache.jmeter.protocol.http.control.HeaderManager;
+import org.apache.jmeter.protocol.http.util.HTTPArgument;
+import org.apache.jmeter.protocol.http.util.HTTPConstants;
+import org.apache.jmeter.protocol.http.util.HTTPFileArg;
+import org.apache.jmeter.samplers.SampleResult;
+import org.apache.jmeter.services.FileServer;
+import org.apache.jmeter.testelement.property.CollectionProperty;
+import org.apache.jmeter.testelement.property.JMeterProperty;
+import org.apache.jmeter.threads.JMeterContextService;
+import org.apache.jmeter.threads.JMeterVariables;
+import org.apache.jmeter.util.JMeterUtils;
+import org.apache.jmeter.util.JsseSSLManager;
+import org.apache.jmeter.util.SSLManager;
+import org.apache.jorphan.util.JOrphanUtils;
+import org.apache.jorphan.util.StringUtilities;
+import org.brotli.dec.BrotliInputStream;
+import org.ietf.jgss.GSSCredential;
+import org.ietf.jgss.GSSException;
+import org.ietf.jgss.GSSManager;
+import org.ietf.jgss.Oid;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * HTTP Sampler using Apache HttpClient 5.x.
+ */
+public class HTTPHC5Impl extends HTTPHCAbstractImpl {
+
+    private static final Logger log = LoggerFactory.getLogger(HTTPHC5Impl.class);
+
+    /** Key used to store the current {@link SampleResult} in the {@link HttpClientContext}. */
+    static final String CONTEXT_ATTRIBUTE_SAMPLER_RESULT = "__jmeter.S_R__"; //$NON-NLS-1$
+
+    private static final ThreadLocal<Map<HttpClientKey, CloseableHttpClient>> HTTP_CLIENTS =
+            new InheritableThreadLocal<>() {
+                @Override
+                protected Map<HttpClientKey, CloseableHttpClient> initialValue() {
+                    return new ConcurrentHashMap<>();
+                }
+            };
+
+    /**
+     * HTTP/2 clients are shared with the threads that download embedded resources in parallel,
+     * so that concurrent requests to the same host can be multiplexed over a single connection.
+     */
+    private static final ThreadLocal<Map<HttpClientKey, CloseableHttpAsyncClient>> HTTP_2_CLIENTS =
+            new InheritableThreadLocal<>() {
+                @Override
+                protected Map<HttpClientKey, CloseableHttpAsyncClient> initialValue() {
+                    return new ConcurrentHashMap<>();
+                }
+            };
+
+    /** Multiplex concurrent message exchanges over a single HTTP/2 connection. */
+    private static final boolean HTTP_2_MULTIPLEXING =
+            JMeterUtils.getPropDefault("httpclient5.h2.multiplexing", true);
+
+    /** Size of the HPACK dynamic header table announced to the server, {@code 0} disables HPACK indexing. */
+    private static final int HTTP_2_HEADER_TABLE_SIZE =
+            JMeterUtils.getPropDefault("httpclient5.h2.header_table_size", H2Config.DEFAULT.getHeaderTableSize());
+
+    /** Whether HPACK compression of the request headers is used. */
+    private static final boolean HTTP_2_HEADER_COMPRESSION =
+            JMeterUtils.getPropDefault("httpclient5.h2.header_compression", true);
+
+    private static final int HTTP_2_MAX_CONCURRENT_STREAMS =
+            JMeterUtils.getPropDefault("httpclient5.h2.max_concurrent_streams", H2Config.DEFAULT.getMaxConcurrentStreams());
+
+    private static final int HTTP_2_INITIAL_WINDOW_SIZE =
+            JMeterUtils.getPropDefault("httpclient5.h2.initial_window_size", H2Config.DEFAULT.getInitialWindowSize());
+
+    private static final int HTTP_2_MAX_FRAME_SIZE =
+            JMeterUtils.getPropDefault("httpclient5.h2.max_frame_size", H2Config.DEFAULT.getMaxFrameSize());
+
+    /**
+     * JMeter has no way of reporting pushed resources, so server push is switched off to avoid
+     * the server wasting bandwidth on responses that are dropped.
+     */
+    private static final boolean HTTP_2_PUSH_ENABLED =
+            JMeterUtils.getPropDefault("httpclient5.h2.push_enabled", false);
+
+    /**
+     * Use HTTP/2 without TLS (h2c with prior knowledge) when HTTP/2 is selected for a {@code http://} URL.
+     * Without prior knowledge such requests silently fall back to HTTP/1.1, as ALPN is unavailable.
+     */
+    private static final boolean HTTP_2_PRIOR_KNOWLEDGE =
+            JMeterUtils.getPropDefault("httpclient5.h2.prior_knowledge", false);
+
+    private static final int HTTP_2_MAX_CONNECTIONS_PER_ROUTE =
+            JMeterUtils.getPropDefault("httpclient5.h2.max_connections_per_route", 6);
+
+    /**
+     * Milliseconds of inactivity after which a pooled connection is re-validated before it is used
+     * again, {@code -1} disables the check. JMeter keeps a client per thread and reuses its
+     * connections across iterations, so a connection the server (or an idle timeout of a load
+     * balancer) closed in between would otherwise be handed out as-is and fail the next sample.
+     * HttpClient leaves this undefined by default, which skips the check altogether, and the
+     * automatic retries that would hide such a failure are deliberately disabled.
+     */
+    private static final long VALIDATE_AFTER_INACTIVITY =
+            JMeterUtils.getPropDefault("httpclient5.validate_after_inactivity", 2000L);
+
+    /**
+     * Name of the property that suppresses the {@code User-Agent} header HttpClient sends when the
+     * test plan does not define one itself.
+     */
+    private static final String DISABLE_DEFAULT_UA_PROPERTY = "httpclient5.default_user_agent_disabled";
+
+    /**
+     * {@code User-Agent} JMeter adds to requests without one, so it shows up in the sample result and
+     * is accounted for in the sent bytes, instead of being added invisibly by HttpClient.
+     */
+    private static final String DEFAULT_USER_AGENT = VersionInfo.getSoftwareInfo("Apache-HttpClient",
+            "org.apache.hc.client5", org.apache.hc.client5.http.impl.classic.HttpClientBuilder.class);
+
+    /** Remembers whether the request had a {@code User-Agent} header before HttpClient added its own. */
+    private static final String CONTEXT_ATTRIBUTE_USER_AGENT_PRESENT = "__jmeter.U_A__";
+
+    private static final HttpRequestInterceptor RECORD_USER_AGENT_PRESENCE = (request, entity, context) ->
+            context.setAttribute(CONTEXT_ATTRIBUTE_USER_AGENT_PRESENT, request.containsHeader(HttpHeaders.USER_AGENT));
+
+    private static final HttpRequestInterceptor REMOVE_DEFAULT_USER_AGENT = (request, entity, context) -> {
+        if (!Boolean.TRUE.equals(context.getAttribute(CONTEXT_ATTRIBUTE_USER_AGENT_PRESENT))) {
+            request.removeHeaders(HttpHeaders.USER_AGENT);
+        }
+    };
+
+    private static final H2Config HTTP_2_CONFIG = createHttp2Config();
+
+    /**
+     * Request that the Kerberos credentials of the JMeter user are delegated to the server, so
+     * that it can act on behalf of the user, see the {@code kerberos.spnego.delegate_cred}
+     * property.
+     */
+    private static final boolean KERBEROS_DELEGATE_CRED =
+            JMeterUtils.getPropDefault("kerberos.spnego.delegate_cred", false);
+
+    /**
+     * HttpClient 5 only offers {@code Bearer}, {@code Digest} and {@code Basic} by default, so the
+     * negotiation based schemes have to be requested explicitly for a Kerberos authorization.
+     */
+    @SuppressWarnings("deprecation") // The GSS based auth schemes of HttpClient 5 have no replacement yet
+    private static final List<String> KERBEROS_PREFERRED_AUTH_SCHEMES =
+            List.of(StandardAuthScheme.SPNEGO, StandardAuthScheme.KERBEROS);
+
+    /**
+     * Auth schemes offered to a proxy that can be authenticated with Kerberos. Unlike the target
+     * schemes these keep the password based schemes as a fallback, so that a proxy which offers
+     * {@code Negotiate} next to {@code Basic} or {@code Digest} can still be used.
+     */
+    @SuppressWarnings("deprecation") // The GSS based auth schemes of HttpClient 5 have no replacement yet
+    private static final List<String> KERBEROS_PROXY_PREFERRED_AUTH_SCHEMES =
+            List.of(StandardAuthScheme.SPNEGO, StandardAuthScheme.KERBEROS, StandardAuthScheme.BEARER,
+                    StandardAuthScheme.DIGEST, StandardAuthScheme.BASIC);
+
+    private static final Oid SPNEGO_OID = createOid("1.3.6.1.5.5.2");
+
+    private static final Oid KERBEROS_OID = createOid("1.2.840.113554.1.2.2");
+
+    /**
+     * Credentials without a principal, telling the negotiation based auth schemes to use the
+     * credentials of the JAAS {@link Subject} the request is executed with.
+     */
+    private static final Credentials USE_JAAS_CREDENTIALS = new Credentials() {
+        @Override
+        public Principal getUserPrincipal() {
+            return null;
+        }
+
+        @Override
+        @SuppressWarnings("deprecation") // Credentials.getPassword is deprecated, but has to be implemented
+        public char[] getPassword() {
+            return new char[0];
+        }
+    };
+
+    private static final Method MESSAGE_MULTIPLEXING_SETTER = findMessageMultiplexingSetter();
+
+    private static final String[] HEADERS_TO_SAVE = {HttpHeaders.CONTENT_LENGTH, HttpHeaders.CONTENT_ENCODING,
+            HttpHeaders.CONTENT_MD5};
+
+    // HttpClient 5.6 switched BrotliInputStreamFactory to the optional brotli4j library, so decode "br"
+    // with the org.brotli:dec library JMeter ships, like HTTPHC4Impl does.
+    @SuppressWarnings("deprecation")
+    private static final InputStreamFactory BROTLI = BrotliInputStream::new;
+
+    // The InputStreamFactory-based decoders are deprecated in favour of the @Internal ContentCodecRegistry,
+    // so keep using them until a public replacement is available.
+    @SuppressWarnings("deprecation")
+    private static final Lookup<InputStreamFactory> CONTENT_DECODERS = RegistryBuilder.<InputStreamFactory>create()
+            .register("br", BROTLI)
+            .register("gzip", GZIPInputStreamFactory.getInstance())
+            .register("x-gzip", GZIPInputStreamFactory.getInstance())
+            .register("deflate", DeflateInputStreamFactory.getInstance())
+            .build();
+
+    private static final TlsStrategy HTTP_2_TLS_STRATEGY = createHttp2TlsStrategy();
+
+    private static final ExecChainHandler RESPONSE_CONTENT_ENCODING = (request, scope, chain) -> {
+        HttpClientContext context = scope.clientContext;
+        RequestConfig requestConfig = context.getRequestConfig();
+        if (requestConfig == null) {
+            requestConfig = RequestConfig.DEFAULT;
+        }
+        ClassicHttpResponse response = chain.proceed(request, scope);
+        if (!requestConfig.isContentCompressionEnabled()) {
+            return response;
+        }
+        return decompressResponse(response);
+    };
+
+    /**
+     * Decodes the response body while keeping the {@code Content-Encoding}, {@code Content-Length} and
+     * {@code Content-MD5} headers, so the sample result still reports what the server actually sent.
+     * JMeter therefore disables the transparent decompression of HttpClient, which drops those headers,
+     * and decodes the response itself for both the HTTP/1.1 and the HTTP/2 transport.
+     */
+    @SuppressWarnings("deprecation") // DecompressingEntity is superseded by the @Internal ContentCodecRegistry
+    private static ClassicHttpResponse decompressResponse(ClassicHttpResponse response) {
+        HttpEntity entity = response.getEntity();
+        if (entity == null || entity.getContentLength() == 0 || entity.getContentEncoding() == null) {
+            return response;
+        }
+
+        Header[][] headersToSave = new Header[HEADERS_TO_SAVE.length][];
+        for (int i = 0; i < HEADERS_TO_SAVE.length; i++) {
+            headersToSave[i] = response.getHeaders(HEADERS_TO_SAVE[i]);
+        }
+        String contentEncoding = entity.getContentEncoding();
+        HeaderElement[] codecs = BasicHeaderValueParser.INSTANCE.parseElements(contentEncoding,
+                new ParserCursor(0, contentEncoding.length()));
+        for (HeaderElement codec : codecs) {
+            InputStreamFactory decoderFactory = CONTENT_DECODERS.lookup(codec.getName().toLowerCase(Locale.ROOT));
+            if (decoderFactory != null) {
+                response.setEntity(new DecompressingEntity(response.getEntity(), decoderFactory));
+                response.removeHeaders(HttpHeaders.CONTENT_LENGTH);
+                response.removeHeaders(HttpHeaders.CONTENT_ENCODING);
+                response.removeHeaders(HttpHeaders.CONTENT_MD5);
+            }
+        }
+        for (Header[] headers : headersToSave) {
+            for (Header header : headers) {
+                if (!response.containsHeader(header.getName())) {
+                    response.addHeader(header);
+                }
+            }
+        }
+        return response;
+    }
+
+    private volatile org.apache.hc.client5.http.classic.methods.HttpUriRequestBase currentRequest;
+
+    private static TlsStrategy createHttp2TlsStrategy() {
+        try {
+            SSLContext sslContext = SSLContexts.custom().loadTrustMaterial(null, TrustAllStrategy.INSTANCE).build();
+            return ClientTlsStrategyBuilder.create()
+                    .setSslContext(sslContext)
+                    // Leave hostname verification to the no-op verifier below. Without CLIENT the policy would
+                    // default to BOTH, and the JSSE built-in endpoint identification would reject the
+                    // self-signed certificates JMeter deliberately accepts when testing.
+                    .setHostVerificationPolicy(HostnameVerificationPolicy.CLIENT)
+                    .setHostnameVerifier(NoopHostnameVerifier.INSTANCE)
+                    .buildAsync();
+        } catch (GeneralSecurityException e) {
+            throw new IllegalStateException("Could not create HTTP/2 TLS strategy", e);
+        }
+    }
+
+    static H2Config createHttp2Config() {
+        return H2Config.custom()
+                .setHeaderTableSize(HTTP_2_HEADER_TABLE_SIZE)
+                .setCompressionEnabled(HTTP_2_HEADER_COMPRESSION)
+                .setMaxConcurrentStreams(HTTP_2_MAX_CONCURRENT_STREAMS)
+                .setInitialWindowSize(HTTP_2_INITIAL_WINDOW_SIZE)
+                .setMaxFrameSize(HTTP_2_MAX_FRAME_SIZE)
+                .setPushEnabled(HTTP_2_PUSH_ENABLED)
+                .build();
+    }
+
+    protected HTTPHC5Impl(HTTPSamplerBase testElement) {
+        super(testElement);
+    }
+
+    @Override
+    protected HTTPSampleResult sample(URL url, String method, boolean areFollowingRedirect, int frameDepth) {
+        HTTPSampleResult result = createSampleResult(url, method);
+        org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request = null;
+        ClassicHttpResponse response = null;
+        try {
+            resetStateIfNeeded();
+            request = createRequest(url.toURI(), method);
+            setupRequest(url, request, result, areFollowingRedirect);
+            result.sampleStart();
+
+            CacheManager cacheManager = getCacheManager();
+            if (cacheManager != null && HTTPConstants.GET.equalsIgnoreCase(method)) {
+                if (cacheManager.inCache(url, request.getHeaders())) {
+                    return updateSampleResultForResourceInCache(result);
+                }
+            }
+
+            currentRequest = request;
+            HttpClientKey clientKey = createHttpClientKey(url);
+            HttpClientContext context = createHttpClientContext(url, clientKey, request);
+            context.setAttribute(CONTEXT_ATTRIBUTE_SAMPLER_RESULT, result);
+            response = executeRequest(url, clientKey, request, context);
+            result.sampleEnd();
+            currentRequest = null;
+
+            updateResult(response, request, result);
+            if (cacheManager != null) {
+                cacheManager.saveDetails(response, result);
+            }
+            saveConnectionCookies(response, result.getURL(), getCookieManager());
+            return resultProcessing(areFollowingRedirect, frameDepth, result);
+        } catch (Exception e) {
+            if (result.getEndTime() == 0) {
+                result.sampleEnd();
+            }
+            if (request != null) {
+                result.setRequestHeaders(getRequestHeaders(request));
+                result.setSentBytes(calculateSentBytes(request));
+            }
+            return errorResult(e, result);
+        } finally {
+            JOrphanUtils.closeQuietly(response);
+            currentRequest = null;
+        }
+    }
+
+    private HTTPSampleResult createSampleResult(URL url, String method) {
+        HTTPSampleResult result = new HTTPSampleResult();
+        configureSampleLabel(result, url);
+        result.setHTTPMethod(method);
+        result.setURL(url);
+        return result;
+    }
+
+    private static org.apache.hc.client5.http.classic.methods.HttpUriRequestBase createRequest(URI uri, String method) {
+        return new org.apache.hc.client5.http.classic.methods.HttpUriRequestBase(method, uri);
+    }
+
+    /**
+     * Executes the request under the JAAS {@link Subject} of the {@link AuthManager}, if the URL or
+     * the proxy is covered by a Kerberos authorization, so that the auth scheme can use its
+     * credentials.
+     */
+    private ClassicHttpResponse executeRequest(URL url, HttpClientKey clientKey,
+            org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request, HttpClientContext context)
+            throws IOException {
+        Subject subject = getSubjectForUrl(url);
+        if (subject == null) {
+            subject = getSubjectForProxy(clientKey);
+        }
+        if (subject == null) {
+            return doExecuteRequest(clientKey, request, context);
+        }
+        try {
+            return Subject.doAs(subject, (PrivilegedExceptionAction<ClassicHttpResponse>) () ->
+                    doExecuteRequest(clientKey, request, context));
+        } catch (PrivilegedActionException e) {
+            Exception cause = e.getException();
+            if (cause instanceof IOException ioException) {
+                throw ioException;
+            }
+            throw new IOException("Could not execute the request with subject " + subject, cause);
+        }
+    }
+
+    private static ClassicHttpResponse doExecuteRequest(HttpClientKey clientKey,
+            org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request, HttpClientContext context)
+            throws IOException {
+        return clientKey.httpVersionPolicy != HttpVersionPolicy.FORCE_HTTP_1
+                ? executeHttp2(getHttp2Client(clientKey), request, context)
+                : getClient(clientKey).executeOpen(null, request, context);
+    }
+
+    private void setupRequest(URL url, org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request,
+            HTTPSampleResult result, boolean areFollowingRedirect) throws IOException {
+        HttpVersionPolicy httpVersionPolicy = getHttpVersionPolicy(testElement.getHttpVersion(), HTTP_VERSION,
+                url.getProtocol());
+        RequestConfig.Builder config = RequestConfig.custom()
+                .setRedirectsEnabled(getAutoRedirects() && !areFollowingRedirect);
+        int responseTimeout = getResponseTimeout();
+        if (responseTimeout > 0) {
+            config.setResponseTimeout(Timeout.ofMilliseconds(responseTimeout));
+        }
+        request.setConfig(config.build());
+        if (httpVersionPolicy == HttpVersionPolicy.FORCE_HTTP_1) {
+            request.setHeader(HTTPConstants.HEADER_CONNECTION,
+                    getUseKeepAlive() ? HTTPConstants.KEEP_ALIVE : HTTPConstants.CONNECTION_CLOSE);
+        } else if (httpVersionPolicy == HttpVersionPolicy.FORCE_HTTP_2) {
+            request.setVersion(HttpVersion.HTTP_2);
+        }
+        setConnectionHeaders(request, getHeaderManager(), httpVersionPolicy);
+        setDefaultUserAgent(request);
+        CacheManager cacheManager = getCacheManager();
+        if (cacheManager != null) {
+            cacheManager.setHeaders(url, request);
+        }
+
+        String cookies = setConnectionCookie(request, url, getCookieManager());
+        if (StringUtilities.isNotEmpty(cookies)) {
+            result.setCookies(cookies);
+        } else {
+            result.setCookies(getOnlyCookieFromHeaders(request));
+        }
+
+        if (canHaveBody(request.getMethod())) {
+            result.setQueryString(setupRequestEntity(request));
+        }
+    }
+
+    private static boolean canHaveBody(String method) {
+        return !HTTPConstants.HEAD.equals(method) && !HTTPConstants.TRACE.equals(method);
+    }
+
+    private String setupRequestEntity(org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request) throws IOException {
+        HTTPFileArg[] files = getHTTPFiles();
+        String contentEncoding = getContentEncoding();
+        Charset charset = Charset.forName(contentEncoding);
+        HttpEntity entity;
+        String requestData;
+        if (getUseMultipart()) {
+            MultipartEntityBuilder builder = MultipartEntityBuilder.create().setCharset(charset);
+            for (JMeterProperty property : getArguments().getEnabledArguments()) {
+                HTTPArgument argument = (HTTPArgument) property.getObjectValue();
+                if (!argument.isSkippable(argument.getName())) {
+                    ContentType contentType = StringUtilities.isNotEmpty(argument.getContentType())
+                            ? ContentType.parse(argument.getContentType())
+                            : ContentType.TEXT_PLAIN.withCharset(charset);
+                    builder.addTextBody(argument.getName(), argument.getValue(), contentType);
+                }
+            }
+            for (HTTPFileArg file : files) {
+                File resolvedFile = FileServer.getFileServer().getResolvedFile(file.getPath());
+                ContentType contentType = StringUtilities.isNotEmpty(file.getMimeType())
+                        ? ContentType.parse(file.getMimeType()) : ContentType.DEFAULT_BINARY;
+                builder.addBinaryBody(file.getParamName(), resolvedFile, contentType, file.getName());
+            }
+            entity = builder.build();
+            requestData = getEntityPreview(entity, contentEncoding);
+        } else if (!hasArguments() && getSendFileAsPostBody()) {
+            HTTPFileArg file = files[0];
+            if (request.getFirstHeader(HTTPConstants.HEADER_CONTENT_TYPE) == null && StringUtilities.isNotEmpty(file.getMimeType())) {
+                request.setHeader(HTTPConstants.HEADER_CONTENT_TYPE, file.getMimeType());
+            }
+            entity = new FileEntity(FileServer.getFileServer().getResolvedFile(file.getPath()), null);
+            requestData = "<actual file content, not shown here>";
+        } else if (getSendParameterValuesAsPostBody()) {
+            StringBuilder body = new StringBuilder();
+            for (JMeterProperty property : getArguments().getEnabledArguments()) {
+                body.append(((HTTPArgument) property.getObjectValue()).getEncodedValue(contentEncoding));
+            }
+            entity = new StringEntity(body.toString(), charset);
+            requestData = body.toString();
+        } else if (hasArguments()) {
+            entity = new UrlEncodedFormEntity(createNameValuePairs(contentEncoding), charset);
+            requestData = getEntityPreview(entity, contentEncoding);
+        } else {
+            return "";
+        }
+        request.setEntity(entity);
+        return requestData;
+    }
+
+    private List<NameValuePair> createNameValuePairs(String contentEncoding) throws IOException {
+        List<NameValuePair> pairs = new ArrayList<>();
+        for (JMeterProperty property : getArguments().getEnabledArguments()) {
+            HTTPArgument argument = (HTTPArgument) property.getObjectValue();
+            String name = argument.getName();
+            if (argument.isSkippable(name)) {
+                continue;
+            }
+            String value = argument.getValue();
+            if (!argument.isAlwaysEncoded()) {
+                name = URLDecoder.decode(name, contentEncoding);
+                value = URLDecoder.decode(value, contentEncoding);
+            }
+            pairs.add(new BasicNameValuePair(name, value));
+        }
+        return pairs;
+    }
+
+    private static String getEntityPreview(HttpEntity entity, String contentEncoding) throws IOException {
+        if (!entity.isRepeatable()) {
+            return "<Entity was not repeatable, cannot view what was sent>";
+        }
+        ByteArrayOutputStream output = new ByteArrayOutputStream();
+        entity.writeTo(output);
+        return output.toString(contentEncoding);
+    }
+
+    private static void setConnectionHeaders(org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request,
+            HeaderManager headerManager, HttpVersionPolicy httpVersionPolicy) {
+        if (headerManager == null) {
+            return;
+        }
+        CollectionProperty headers = headerManager.getHeaders();
+        if (headers == null) {
+            return;
+        }
+        for (JMeterProperty property : headers) {
+            org.apache.jmeter.protocol.http.control.Header header =
+                    (org.apache.jmeter.protocol.http.control.Header) property.getObjectValue();
+            if (!HTTPConstants.HEADER_CONTENT_LENGTH.equalsIgnoreCase(header.getName())
+                    && (httpVersionPolicy == HttpVersionPolicy.FORCE_HTTP_1
+                    || !HTTPConstants.HEADER_CONNECTION.equalsIgnoreCase(header.getName()))) {
+                request.addHeader(header.getName(), header.getValue());
+            }
+        }
+    }
+
+    private static void setDefaultUserAgent(org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request) {
+        if (isDefaultUserAgentDisabled() || request.containsHeader(HttpHeaders.USER_AGENT)) {
+            return;
+        }
+        request.setHeader(HttpHeaders.USER_AGENT, DEFAULT_USER_AGENT);
+    }
+
+    private static String setConnectionCookie(org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request,
+            URL url, CookieManager cookieManager) {
+        if (cookieManager == null) {
+            return null;
+        }
+        String cookies = cookieManager.getCookieHeaderForURL(url);
+        if (cookies != null) {
+            request.setHeader(HTTPConstants.HEADER_COOKIE, cookies);
+        }
+        return cookies;
+    }
+
+    HttpClientContext createHttpClientContext(URL url, HttpClientKey key,
+            org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request) {
+        HttpClientContext context = HttpClientContext.create();
+        BasicCredentialsProvider credentialsProvider = new BasicCredentialsProvider();
+        Authorization authorization = getAuthorizationForUrl(url);
+        configureTargetCredentials(url, request, credentialsProvider, authorization);
+        configureProxyCredentials(key, credentialsProvider);
+        boolean kerberosTarget = isKerberos(authorization);
+        boolean kerberosProxy = isKerberosProxy(key);
+        if (kerberosTarget || kerberosProxy) {
+            configureKerberos(url, key, request, context, credentialsProvider, kerberosTarget, kerberosProxy);
+        } else {
+            context.setCredentialsProvider(credentialsProvider);
+        }
+        return context;
+    }
+
+    private Authorization getAuthorizationForUrl(URL url) {
+        AuthManager authManager = getAuthManager();
+        return authManager == null || url == null ? null : authManager.getAuthForURL(url);
+    }
+
+    /**
+     * A proxy is authenticated with Kerberos, if the {@link AuthManager} holds a Kerberos
+     * authorization for it, or if it has no credentials configured at all. Enterprise proxies
+     * commonly challenge with {@code Proxy-Authenticate: Negotiate}, which can only be answered
+     * with the Kerberos ticket of the JMeter user, as JMeter has no place to configure proxy
+     * credentials for a negotiation based scheme.
+     */
+    private boolean isKerberosProxy(HttpClientKey key) {
+        if (!key.hasProxy) {
+            return false;
+        }
+        return StringUtilities.isEmpty(key.proxyUser) || isKerberos(getAuthorizationForUrl(getProxyUrl(key)));
+    }
+
+    private static URL getProxyUrl(HttpClientKey key) {
+        if (!key.hasProxy) {
+            return null;
+        }
+        String scheme = StringUtilities.isEmpty(key.proxyScheme) ? HTTPConstants.PROTOCOL_HTTP : key.proxyScheme;
+        try {
+            return new URL(scheme, key.proxyHost, key.proxyPort, "");
+        } catch (MalformedURLException e) {
+            log.debug("Could not build a URL for proxy {}://{}:{}", scheme, key.proxyHost, key.proxyPort, e);
+            return null;
+        }
+    }
+
+    private static boolean isKerberos(Authorization authorization) {
+        return authorization != null && AuthManager.Mechanism.KERBEROS.equals(authorization.getMechanism());
+    }
+
+    private static void configureTargetCredentials(URL url,
+            org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request,
+            BasicCredentialsProvider credentialsProvider, Authorization authorization) {
+        if (authorization == null || isKerberos(authorization)) {
+            // The credentials of a Kerberos authorization are used to log in to the KDC, they must
+            // not be sent to the server
+            return;
+        }
+        credentialsProvider.setCredentials(new AuthScope(url.getHost(), getPort(url)),
+                new UsernamePasswordCredentials(authorization.getUser(), authorization.getPass().toCharArray()));
+        if (AuthManager.Mechanism.BASIC.equals(authorization.getMechanism())) {
+            request.setHeader(HttpHeaders.AUTHORIZATION, authorization.toBasicHeader());
+        }
+    }
+
+    /**
+     * Sets up the {@code Negotiate} and {@code Kerberos} auth schemes for a single request, as
+     * HttpClient 5 neither registers them nor prefers them by default. The credentials are taken
+     * from the JAAS {@link Subject} the {@link AuthManager} logged the user in with. The schemes
+     * are set up for the target, for the proxy, or for both, depending on which of them is
+     * covered by a Kerberos authorization.
+     */
+    @SuppressWarnings("deprecation") // The GSS based auth schemes of HttpClient 5 have no replacement yet
+    private void configureKerberos(URL url, HttpClientKey key,
+            org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request,
+            HttpClientContext context, CredentialsProvider credentialsProvider,
+            boolean kerberosTarget, boolean kerberosProxy) {
+        KerberosConfig kerberosConfig = KerberosConfig.custom()
+                .setStripPort(isStripPort(url))
+                .setUseCanonicalHostname(AuthManager.USE_CANONICAL_HOST_NAME)
+                .setRequestDelegCreds(KERBEROS_DELEGATE_CRED
+                        ? KerberosConfig.Option.ENABLE : KerberosConfig.Option.DEFAULT)
+                .build();
+        DnsResolver dnsResolver = SystemDefaultDnsResolver.INSTANCE;
+        context.setAuthSchemeRegistry(RegistryBuilder.<AuthSchemeFactory>create()
+                .register(StandardAuthScheme.BASIC, BasicSchemeFactory.INSTANCE)
+                .register(StandardAuthScheme.DIGEST, DigestSchemeFactory.INSTANCE)
+                .register(StandardAuthScheme.BEARER, BearerSchemeFactory.INSTANCE)
+                .register(StandardAuthScheme.SPNEGO, new SPNegoSchemeFactory(kerberosConfig, dnsResolver))
+                .register(StandardAuthScheme.KERBEROS, new KerberosSchemeFactory(kerberosConfig, dnsResolver))
+                .build());
+        context.setCredentialsProvider(new KerberosCredentialsProvider(
+                kerberosTarget ? getSubjectForUrl(url) : null,
+                kerberosProxy ? getProxyHost(key) : null,
+                kerberosProxy ? getSubjectForProxy(key) : null,
+                credentialsProvider));
+        RequestConfig requestConfig = request.getConfig() == null ? RequestConfig.DEFAULT : request.getConfig();
+        RequestConfig.Builder builder = RequestConfig.copy(requestConfig);
+        if (kerberosTarget) {
+            builder.setTargetPreferredAuthSchemes(KERBEROS_PREFERRED_AUTH_SCHEMES);
+        }
+        if (kerberosProxy) {
+            builder.setProxyPreferredAuthSchemes(KERBEROS_PROXY_PREFERRED_AUTH_SCHEMES);
+        }
+        request.setConfig(builder.build());
+    }
+
+    private static HttpHost getProxyHost(HttpClientKey key) {
+        return key.hasProxy ? new HttpHost(key.proxyScheme, key.proxyHost, key.proxyPort) : null;
+    }
+
+    /**
+     * IE and Firefox always strip the port from the URL before they construct the SPN, see the
+     * {@code kerberos.spnego.strip_port} property.
+     */
+    private static boolean isStripPort(URL url) {
+        if (AuthManager.STRIP_PORT) {
+            return true;
+        }
+        int port = url.getPort();
+        return port == HTTPConstants.DEFAULT_HTTP_PORT || port == HTTPConstants.DEFAULT_HTTPS_PORT;
+    }
+
+    private Subject getSubjectForUrl(URL url) {
+        AuthManager authManager = getAuthManager();
+        return authManager == null || url == null ? null : authManager.getSubjectForUrl(url);
+    }
+
+    private Subject getSubjectForProxy(HttpClientKey key) {
+        return getSubjectForUrl(getProxyUrl(key));
+    }
+
+    private static Oid createOid(String oid) {
+        try {
+            return new Oid(oid);
+        } catch (GSSException e) {
+            log.warn("Could not create OID {}", oid, e);
+            return null;
+        }
+    }
+
+    /**
+     * Provides the GSS credentials of a JAAS {@link Subject} to the negotiation based auth schemes.
+     * The HTTP/2 transport builds the token on an I/O reactor thread, which is not covered by the
+     * {@link Subject#doAs(Subject, PrivilegedExceptionAction)} the HTTP/1.1 request is executed
+     * with, so the credentials have to be passed to HttpClient explicitly.
+     */
+    private static final class KerberosCredentialsProvider implements CredentialsProvider {
+
+        private final Subject targetSubject;
+        private final HttpHost proxy;
+        private final Subject proxySubject;
+        private final CredentialsProvider delegate;
+        private final Map<String, Credentials> credentialsCache = new HashMap<>();
+
+        private KerberosCredentialsProvider(Subject targetSubject, HttpHost proxy, Subject proxySubject,
+                CredentialsProvider delegate) {
+            this.targetSubject = targetSubject;
+            this.proxy = proxy;
+            this.proxySubject = proxySubject;
+            this.delegate = delegate;
+        }
+
+        @Override
+        @SuppressWarnings("deprecation") // The GSS based auth schemes of HttpClient 5 have no replacement yet
+        public Credentials getCredentials(AuthScope authScope, HttpContext context) {
+            String schemeName = authScope == null ? null : authScope.getSchemeName();
+            if (StandardAuthScheme.SPNEGO.equalsIgnoreCase(schemeName)) {
+                return getKerberosCredentials(schemeName, SPNEGO_OID, authScope);
+            }
+            if (StandardAuthScheme.KERBEROS.equalsIgnoreCase(schemeName)) {
+                return getKerberosCredentials(schemeName, KERBEROS_OID, authScope);
+            }
+            return delegate.getCredentials(authScope, context);
+        }
+
+        private Credentials getKerberosCredentials(String schemeName, Oid oid, AuthScope authScope) {
+            boolean forProxy = isProxy(authScope);
+            Subject subject = forProxy ? proxySubject : targetSubject;
+            return credentialsCache.computeIfAbsent(schemeName + (forProxy ? "@proxy" : "@target"),
+                    name -> createKerberosCredentials(subject, oid));
+        }
+
+        private boolean isProxy(AuthScope authScope) {
+            return proxy != null && proxy.getHostName().equalsIgnoreCase(authScope.getHost())
+                    && (authScope.getPort() <= 0 || authScope.getPort() == proxy.getPort());
+        }
+
+        @SuppressWarnings("deprecation") // KerberosCredentials is deprecated without a replacement
+        private static Credentials createKerberosCredentials(Subject subject, Oid oid) {
+            if (subject == null || oid == null) {
+                return USE_JAAS_CREDENTIALS;
+            }
+            try {
+                GSSCredential gssCredential = Subject.doAs(subject,
+                        (PrivilegedExceptionAction<GSSCredential>) () -> GSSManager.getInstance()
+                                .createCredential(null, GSSCredential.DEFAULT_LIFETIME, oid,
+                                        GSSCredential.INITIATE_ONLY));
+                return new KerberosCredentials(gssCredential);
+            } catch (PrivilegedActionException e) {
+                log.warn("Could not obtain the GSS credentials of subject {}, "
+                        + "falling back to the credentials of the current context", subject, e.getException());
+                return USE_JAAS_CREDENTIALS;
+            }
+        }
+    }
+
+    private static void configureProxyCredentials(HttpClientKey key, BasicCredentialsProvider credentialsProvider) {
+        if (key.hasProxy && StringUtilities.isNotEmpty(key.proxyUser)) {
+            credentialsProvider.setCredentials(new AuthScope(key.proxyHost, key.proxyPort),
+                    new UsernamePasswordCredentials(key.proxyUser, key.proxyPass.toCharArray()));
+        }
+    }
+
+    private static int getPort(URL url) {
+        return url.getPort() == -1 ? url.getDefaultPort() : url.getPort();
+    }
+
+    private void updateResult(ClassicHttpResponse response,
+            org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request, HTTPSampleResult result) throws IOException {
+        result.setRequestHeaders(getRequestHeaders(request));
+        result.setSentBytes(calculateSentBytes(request));
+        Header contentType = response.getFirstHeader(HTTPConstants.HEADER_CONTENT_TYPE);
+        if (contentType != null) {
+            result.setContentType(contentType.getValue());
+            result.setEncodingAndType(contentType.getValue());
+        }
+        HttpEntity entity = response.getEntity();
+        long bodySize = 0;
+        if (entity != null) {
+            byte[] body = readResponse(result, entity.getContent(), entity.getContentLength());
+            result.setResponseData(body);
+            bodySize = body.length;
+        }
+        int statusCode = response.getCode();
+        result.setResponseCode(Integer.toString(statusCode));
+        result.setResponseMessage(response.getReasonPhrase());
+        result.setSuccessful(isSuccessCode(statusCode));
+        result.setResponseHeaders(getResponseHeaders(response));
+        result.setHeadersSize(result.getResponseHeaders().length());
+        result.setBodySize(bodySize);
+        if (result.isRedirect()) {
+            Header location = response.getFirstHeader(HTTPConstants.HEADER_LOCATION);
+            if (location != null) {
+                result.setRedirectLocation(location.getValue());
+            }
+        }
+    }
+
+    private static String getResponseHeaders(ClassicHttpResponse response) {
+        StringBuilder headers = new StringBuilder();
+        headers.append(response.getVersion()).append(' ').append(response.getCode()).append(' ')
+                .append(response.getReasonPhrase()).append('\n');
+        for (Header header : response.getHeaders()) {
+            headers.append(header.getName()).append(": ").append(header.getValue()).append('\n');
+        }
+        return headers.toString();
+    }
+
+    private static String getRequestHeaders(org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request) {
+        StringBuilder headers = new StringBuilder();
+        for (Header header : request.getHeaders()) {
+            if (ALL_EXCEPT_COOKIE.test(header.getName())) {
+                headers.append(header.getName()).append(": ").append(header.getValue()).append('\n');
+            }
+        }
+        return headers.toString();
+    }
+
+    private static long calculateSentBytes(org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request) {
+        if (request == null) {
+            return 0;
+        }
+        long sentBytes = 0;
+
+        String method = request.getMethod();
+        String uri = request.getRequestUri();
+        if (uri == null) {
+            uri = "";
+        }
+        org.apache.hc.core5.http.ProtocolVersion version = request.getVersion();
+        String versionStr = version != null ? version.toString() : "HTTP/1.1";
+
+        sentBytes += method.getBytes(Charset.defaultCharset()).length;
+        sentBytes += 1;
+        sentBytes += uri.getBytes(Charset.defaultCharset()).length;
+        sentBytes += 1;
+        sentBytes += versionStr.getBytes(Charset.defaultCharset()).length;
+        sentBytes += 2;
+
+        for (Header header : request.getHeaders()) {
+            String name = header.getName();
+            String value = header.getValue();
+            if (name != null) {
+                sentBytes += name.getBytes(Charset.defaultCharset()).length;
+                sentBytes += 2;
+            }
+            if (value != null) {
+                sentBytes += value.getBytes(Charset.defaultCharset()).length;
+            }
+            sentBytes += 2;
+        }
+        sentBytes += 2;
+
+        HttpEntity entity = request.getEntity();
+        if (entity != null) {
+            long contentLength = entity.getContentLength();
+            if (contentLength >= 0) {
+                sentBytes += contentLength;
+            } else if (entity.isRepeatable()) {
+                CountingOutputStream counter = new CountingOutputStream();
+                try {
+                    entity.writeTo(counter);
+                    sentBytes += counter.getCount();
+                } catch (IOException e) {
+                    log.debug("Exception measuring entity length", e);
+                }
+            }
+        }
+
+        return sentBytes;
+    }
+
+    private static class CountingOutputStream extends java.io.OutputStream {
+        private long count = 0;
+
+        @Override
+        public void write(int b) {
+            count++;
+        }
+
+        @Override
+        public void write(byte[] b, int off, int len) {
+            count += len;
+        }
+
+        long getCount() {
+            return count;
+        }
+    }
+
+    private static String getOnlyCookieFromHeaders(org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request) {
+        Header cookie = request.getFirstHeader(HTTPConstants.HEADER_COOKIE);
+        return cookie == null ? "" : cookie.getValue();
+    }
+
+    private static void saveConnectionCookies(ClassicHttpResponse response, URL url, CookieManager cookieManager) {
+        if (cookieManager == null) {
+            return;
+        }
+        for (Header header : response.getHeaders(HTTPConstants.HEADER_SET_COOKIE)) {
+            cookieManager.addCookieFromHeader(header.getValue(), url);
+        }
+    }
+
+    private static CloseableHttpClient getClient(HttpClientKey key) {
+        Map<HttpClientKey, CloseableHttpClient> clients = HTTP_CLIENTS.get();
+        return clients.computeIfAbsent(key, HTTPHC5Impl::createClient);
+    }
+
+    private static CloseableHttpAsyncClient getHttp2Client(HttpClientKey key) {
+        Map<HttpClientKey, CloseableHttpAsyncClient> clients = HTTP_2_CLIENTS.get();
+        return clients.computeIfAbsent(key, HTTPHC5Impl::createHttp2Client);
+    }
+
+    private static boolean isDefaultUserAgentDisabled() {
+        return JMeterUtils.getPropDefault(DISABLE_DEFAULT_UA_PROPERTY, false);
+    }
+
+    private static CloseableHttpClient createClient(HttpClientKey key) {
+        org.apache.hc.client5.http.impl.classic.HttpClientBuilder builder = HttpClients.custom().disableAutomaticRetries();
+        if (isDefaultUserAgentDisabled()) {
+            builder.disableDefaultUserAgent();
+        }
+        PoolingHttpClientConnectionManagerBuilder connectionManagerBuilder = PoolingHttpClientConnectionManagerBuilder.create();
+        connectionManagerBuilder.setDefaultTlsConfig(TlsConfig.custom()
+                .setVersionPolicy(key.httpVersionPolicy)
+                .build());
+        if (key.dnsCacheManager != null) {
+            connectionManagerBuilder.setDnsResolver(createDnsResolver(key.dnsCacheManager));
+        }
+        ConnectionConfig.Builder connectionConfig = ConnectionConfig.custom()
+                .setValidateAfterInactivity(TimeValue.ofMilliseconds(VALIDATE_AFTER_INACTIVITY));
+        if (key.connectTimeout > 0) {
+            connectionConfig.setConnectTimeout(Timeout.ofMilliseconds(key.connectTimeout));
+        }
+        connectionManagerBuilder.setDefaultConnectionConfig(connectionConfig.build());
+        builder.setConnectionManager(new ConnectTimeMeasuringConnectionManager(connectionManagerBuilder.build()));
+        builder.setRoutePlanner(createRoutePlanner(key));
+        return builder.disableContentCompression()
+                .addExecInterceptorFirst("response-content-encoding", RESPONSE_CONTENT_ENCODING)
+                .build();
+    }
+
+    private static CloseableHttpAsyncClient createHttp2Client(HttpClientKey key) {
+        boolean multiplexing = HTTP_2_MULTIPLEXING && MESSAGE_MULTIPLEXING_SETTER != null;
+        HttpAsyncClientBuilder builder = HttpAsyncClients.custom()
+                .disableAutomaticRetries()
+                // HttpClient 5.6 added transparent content compression to the async transport. JMeter decodes
+                // the response itself, so the HTTP/2 sampler reports the same headers as the HTTP/1.1 one and
+                // does not depend on the optional codec libraries HttpClient detects on the classpath.
+                .disableContentCompression()
+                .setH2Config(HTTP_2_CONFIG)
+                .setRoutePlanner(createRoutePlanner(key));
+        if (multiplexing) {
+            // A connection bound to a user token cannot be shared, and HTTP/2 has no connection scoped state anyway
+            builder.disableConnectionState();
+        }
+        if (isDefaultUserAgentDisabled()) {
+            // HttpAsyncClientBuilder has no disableDefaultUserAgent, so the generated header is dropped again
+            builder.addRequestInterceptorFirst(RECORD_USER_AGENT_PRESENCE);
+            builder.addRequestInterceptorLast(REMOVE_DEFAULT_USER_AGENT);
+        }
+        PoolingAsyncClientConnectionManagerBuilder connectionManagerBuilder = PoolingAsyncClientConnectionManagerBuilder.create();
+        connectionManagerBuilder.setTlsStrategy(HTTP_2_TLS_STRATEGY);
+        connectionManagerBuilder.setDefaultTlsConfig(TlsConfig.custom()
+                .setVersionPolicy(key.httpVersionPolicy)
+                .build());
+        if (multiplexing) {
+            enableMessageMultiplexing(connectionManagerBuilder);
+        }
+        connectionManagerBuilder.setPoolConcurrencyPolicy(PoolConcurrencyPolicy.LAX);
+        connectionManagerBuilder.setMaxConnPerRoute(HTTP_2_MAX_CONNECTIONS_PER_ROUTE);
+        if (key.dnsCacheManager != null) {
+            connectionManagerBuilder.setDnsResolver(createDnsResolver(key.dnsCacheManager));
+        }
+        // Without this an HTTP/2 connection is leased straight out of the pool, and a connection the
+        // server closed while the thread was idle only shows up when the request is written to it,
+        // which fails the sample with a ConnectionClosedException. The check sends an HTTP/2 PING
+        // and replaces the connection if the peer does not answer.
+        ConnectionConfig.Builder connectionConfig = ConnectionConfig.custom()
+                .setValidateAfterInactivity(TimeValue.ofMilliseconds(VALIDATE_AFTER_INACTIVITY));
+        if (key.connectTimeout > 0) {
+            connectionConfig.setConnectTimeout(Timeout.ofMilliseconds(key.connectTimeout));
+        }
+        connectionManagerBuilder.setDefaultConnectionConfig(connectionConfig.build());
+        builder.setConnectionManager(new ConnectTimeMeasuringAsyncConnectionManager(connectionManagerBuilder.build()));
+        CloseableHttpAsyncClient asyncClient = builder.build();
+        asyncClient.start();
+        return asyncClient;
+    }
+
+    /**
+     * Looks up {@code PoolingAsyncClientConnectionManagerBuilder#setMessageMultiplexing(boolean)},
+     * which is only available from HttpClient 5.5 onwards. JMeter still runs with older HttpClient
+     * versions, where HTTP/2 requests just cannot share a connection.
+     */
+    private static Method findMessageMultiplexingSetter() {
+        try {
+            return PoolingAsyncClientConnectionManagerBuilder.class.getMethod("setMessageMultiplexing", boolean.class);
+        } catch (NoSuchMethodException e) {
+            log.info("HTTP/2 message multiplexing is unavailable, HttpClient 5.5 or later is required");
+            return null;
+        }
+    }
+
+    private static void enableMessageMultiplexing(PoolingAsyncClientConnectionManagerBuilder connectionManagerBuilder) {
+        try {
+            MESSAGE_MULTIPLEXING_SETTER.invoke(connectionManagerBuilder, true);
+        } catch (IllegalAccessException | InvocationTargetException e) {
+            log.warn("Could not enable HTTP/2 message multiplexing", e);
+        }
+    }
+
+    @SuppressWarnings("deprecation") // SimpleHttpRequest.copy is required for HttpClient 5.3 compatibility
+    private static ClassicHttpResponse executeHttp2(CloseableHttpAsyncClient client,
+            org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request, HttpClientContext context)
+            throws IOException {
+        SimpleHttpRequest asyncRequest = SimpleHttpRequest.copy(request);
+        asyncRequest.setConfig(request.getConfig());
+        HttpEntity requestEntity = request.getEntity();
+        if (requestEntity != null) {
+            asyncRequest.setBody(EntityUtils.toByteArray(requestEntity),
+                    requestEntity.getContentType() == null ? ContentType.DEFAULT_BINARY
+                            : ContentType.parse(requestEntity.getContentType()));
+        }
+        Future<SimpleHttpResponse> responseFuture = client.execute(asyncRequest, context, null);
+        try {
+            return createClassicResponse(responseFuture.get(getHttp2ExecutionTimeoutMillis(request), TimeUnit.MILLISECONDS));
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IOException("Interrupted while executing HTTP/2 request", e);
+        } catch (TimeoutException e) {
+            responseFuture.cancel(true);
+            throw new IOException("Timed out while executing HTTP/2 request", e);
+        } catch (ExecutionException e) {
+            throw new IOException("Could not execute HTTP/2 request", e.getCause());
+        }
+    }
+
+    /**
+     * The future is only a safety net: HttpClient enforces the configured response timeout itself,
+     * so this waits a little longer than the sampler is willing to wait for the response.
+     */
+    private static long getHttp2ExecutionTimeoutMillis(
+            org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request) {
+        RequestConfig requestConfig = request.getConfig();
+        Timeout responseTimeout = requestConfig == null ? null : requestConfig.getResponseTimeout();
+        if (responseTimeout == null || responseTimeout.toMilliseconds() <= 0) {
+            return TimeUnit.MINUTES.toMillis(1);
+        }
+        return responseTimeout.toMilliseconds() + TimeUnit.SECONDS.toMillis(5);
+    }
+
+    private static ClassicHttpResponse createClassicResponse(SimpleHttpResponse asyncResponse) {
+        BasicClassicHttpResponse response = new BasicClassicHttpResponse(asyncResponse.getCode(),
+                asyncResponse.getReasonPhrase());
+        response.setVersion(asyncResponse.getVersion());
+        for (Header header : asyncResponse.getHeaders()) {
+            response.addHeader(header);
+        }
+        byte[] responseBody = asyncResponse.getBodyBytes();
+        if (responseBody != null) {
+            response.setEntity(new ByteArrayEntity(responseBody, asyncResponse.getContentType(),
+                    asyncResponse.getFirstHeader(HttpHeaders.CONTENT_ENCODING) == null ? null
+                            : asyncResponse.getFirstHeader(HttpHeaders.CONTENT_ENCODING).getValue()));
+        }
+        return decompressResponse(response);
+    }
+
+    private static DefaultRoutePlanner createRoutePlanner(HttpClientKey key) {
+        return new DefaultRoutePlanner(null) {
+            @Override
+            protected HttpHost determineProxy(HttpHost target, org.apache.hc.core5.http.protocol.HttpContext context) {
+                return getProxyHost(key);
+            }
+
+            @Override
+            protected InetAddress determineLocalAddress(HttpHost firstHop,
+                    org.apache.hc.core5.http.protocol.HttpContext context) {
+                return key.localAddress;
+            }
+        };
+    }
+
+    private static org.apache.hc.client5.http.DnsResolver createDnsResolver(DNSCacheManager dnsCacheManager) {
+        return new org.apache.hc.client5.http.DnsResolver() {
+            @Override
+            public InetAddress[] resolve(String host) throws UnknownHostException {
+                return dnsCacheManager.resolve(host);
+            }
+
+            @Override
+            public String resolveCanonicalHostname(String host) throws UnknownHostException {
+                InetAddress[] addresses = resolve(host);
+                return addresses == null || addresses.length == 0 ? host : addresses[0].getCanonicalHostName();
+            }
+        };
+    }
+
+    HttpClientKey createHttpClientKey(URL url) throws IOException {
+        String proxyScheme = getProxyScheme();
+        String proxyHost = getProxyHost();
+        int proxyPort = getProxyPortInt();
+        int connectTimeout = getConnectTimeout();
+        String proxyUser = getProxyUser();
+        String proxyPass = getProxyPass();
+        DNSCacheManager dnsCacheManager = testElement.getDNSResolver();
+        InetAddress localAddress = getIpSourceAddress();
+        boolean useDynamicProxy = isDynamicProxy(proxyHost, proxyPort);
+        boolean useStaticProxy = isStaticProxy(url.getHost());
+        HttpVersionPolicy httpVersionPolicy = getHttpVersionPolicy(testElement.getHttpVersion(), HTTP_VERSION,
+                url.getProtocol());
+        if (!useDynamicProxy) {
+            proxyScheme = PROXY_SCHEME;
+            proxyHost = PROXY_HOST;
+            proxyPort = PROXY_PORT;
+        }
+        return new HttpClientKey(url.getProtocol(), url.getAuthority(), useDynamicProxy || useStaticProxy,
+                proxyScheme, proxyHost, proxyPort, proxyUser, proxyPass, connectTimeout, dnsCacheManager, localAddress,
+                httpVersionPolicy);
+    }
+
+    static HttpVersionPolicy getHttpVersionPolicy(String samplerHttpVersion, String defaultHttpVersion) {
+        String httpVersion = StringUtilities.isBlank(samplerHttpVersion) ? defaultHttpVersion : samplerHttpVersion;
+        if (HTTPConstants.HTTP_VERSION_2_STRICT.equalsIgnoreCase(httpVersion)) {
+            return HttpVersionPolicy.FORCE_HTTP_2;
+        }
+        return HTTPConstants.HTTP_VERSION_2.equals(httpVersion) || "2".equals(httpVersion)
+                ? HttpVersionPolicy.NEGOTIATE : HttpVersionPolicy.FORCE_HTTP_1;
+    }
+
+    /**
+     * Determines the version policy for a request to the given scheme. Plain HTTP does not support
+     * ALPN, so HTTP/2 can only be used over {@code http://} when the client assumes that the server
+     * speaks HTTP/2 (h2c with prior knowledge). {@code HTTP/2 Strict} keeps its policy for every
+     * scheme, as it requires HTTP/2 either way.
+     */
+    static HttpVersionPolicy getHttpVersionPolicy(String samplerHttpVersion, String defaultHttpVersion, String scheme) {
+        HttpVersionPolicy policy = getHttpVersionPolicy(samplerHttpVersion, defaultHttpVersion);
+        if (policy == HttpVersionPolicy.NEGOTIATE && HTTP_2_PRIOR_KNOWLEDGE
+                && !HTTPConstants.PROTOCOL_HTTPS.equalsIgnoreCase(scheme)) {
+            return HttpVersionPolicy.FORCE_HTTP_2;
+        }
+        return policy;
+    }
+
+    @Override
+    protected void notifyFirstSampleAfterLoopRestart() {
+        JMeterVariables variables = JMeterContextService.getContext().getVariables();
+        resetStateOnThreadGroupIteration.set(variables != null && !variables.isSameUserOnNextIteration()
+                && RESET_STATE_ON_THREAD_GROUP_ITERATION);
+    }
+
+    private static void resetStateIfNeeded() {
+        if (resetStateOnThreadGroupIteration.get()) {
+            closeThreadLocalClients();
+            ((JsseSSLManager) SSLManager.getInstance()).resetContext();
+            resetStateOnThreadGroupIteration.set(false);
+        }
+    }
+
+    @Override
+    protected void threadFinished() {
+        closeThreadLocalClients();
+    }
+
+    private static void closeThreadLocalClients() {
+        Map<HttpClientKey, CloseableHttpClient> clients = HTTP_CLIENTS.get();
+        for (CloseableHttpClient client : clients.values()) {
+            JOrphanUtils.closeQuietly(client);
+        }
+        clients.clear();
+        Map<HttpClientKey, CloseableHttpAsyncClient> http2Clients = HTTP_2_CLIENTS.get();
+        for (CloseableHttpAsyncClient client : http2Clients.values()) {
+            JOrphanUtils.closeQuietly(client);
+        }
+        http2Clients.clear();
+    }
+
+    @Override
+    public boolean interrupt() {
+        org.apache.hc.client5.http.classic.methods.HttpUriRequestBase request = currentRequest;
+        if (request != null) {
+            currentRequest = null;
+            request.cancel();
+        }
+        return request != null;
+    }
+
+    private static void recordConnectEnd(HttpContext context) {
+        SampleResult sample = (SampleResult) context.getAttribute(CONTEXT_ATTRIBUTE_SAMPLER_RESULT);
+        if (sample != null) {
+            sample.connectEnd();
+        }
+    }
+
+    /**
+     * Delegating connection manager that records the connect time of the current sample
+     * as soon as the connection to the first hop has been established.
+     */
+    static final class ConnectTimeMeasuringConnectionManager implements HttpClientConnectionManager {
+
+        private final HttpClientConnectionManager delegate;
+
+        ConnectTimeMeasuringConnectionManager(HttpClientConnectionManager delegate) {
+            this.delegate = delegate;
+        }
+
+        @Override
+        public LeaseRequest lease(String id, HttpRoute route, Timeout requestTimeout, Object state) {
+            return delegate.lease(id, route, requestTimeout, state);
+        }
+
+        @Override
+        public void release(ConnectionEndpoint endpoint, Object newState, TimeValue validDuration) {
+            delegate.release(endpoint, newState, validDuration);
+        }
+
+        @Override
+        public void connect(ConnectionEndpoint endpoint, TimeValue connectTimeout, HttpContext context) throws IOException {
+            try {
+                delegate.connect(endpoint, connectTimeout, context);
+            } finally {
+                recordConnectEnd(context);
+            }
+        }
+
+        @Override
+        public void upgrade(ConnectionEndpoint endpoint, HttpContext context) throws IOException {
+            delegate.upgrade(endpoint, context);
+        }
+
+        @Override
+        public void close(CloseMode closeMode) {
+            delegate.close(closeMode);
+        }
+
+        @Override
+        public void close() throws IOException {
+            delegate.close();
+        }
+    }
+
+    /**
+     * Delegating asynchronous connection manager that records the connect time of the current
+     * sample as soon as the connection to the first hop has been established.
+     */
+    private static final class ConnectTimeMeasuringAsyncConnectionManager implements AsyncClientConnectionManager {
+
+        private final AsyncClientConnectionManager delegate;
+
+        private ConnectTimeMeasuringAsyncConnectionManager(AsyncClientConnectionManager delegate) {
+            this.delegate = delegate;
+        }
+
+        @Override
+        public Future<AsyncConnectionEndpoint> lease(String id, HttpRoute route, Object state, Timeout requestTimeout,
+                FutureCallback<AsyncConnectionEndpoint> callback) {
+            return delegate.lease(id, route, state, requestTimeout, callback);
+        }
+
+        @Override
+        public void release(AsyncConnectionEndpoint endpoint, Object newState, TimeValue validDuration) {
+            delegate.release(endpoint, newState, validDuration);
+        }
+
+        @Override
+        public Future<AsyncConnectionEndpoint> connect(AsyncConnectionEndpoint endpoint,
+                ConnectionInitiator connectionInitiator, Timeout connectTimeout, Object attachment,
+                HttpContext context, FutureCallback<AsyncConnectionEndpoint> callback) {
+            return delegate.connect(endpoint, connectionInitiator, connectTimeout, attachment, context,
+                    new FutureCallback<>() {
+                        @Override
+                        public void completed(AsyncConnectionEndpoint result) {
+                            recordConnectEnd(context);
+                            if (callback != null) {
+                                callback.completed(result);
+                            }
+                        }
+
+                        @Override
+                        public void failed(Exception ex) {
+                            recordConnectEnd(context);
+                            if (callback != null) {
+                                callback.failed(ex);
+                            }
+                        }
+
+                        @Override
+                        public void cancelled() {
+                            recordConnectEnd(context);
+                            if (callback != null) {
+                                callback.cancelled();
+                            }
+                        }
+                    });
+        }
+
+        @Override
+        public void upgrade(AsyncConnectionEndpoint endpoint, Object attachment, HttpContext context) {
+            delegate.upgrade(endpoint, attachment, context);
+        }
+
+        @Override
+        public void upgrade(AsyncConnectionEndpoint endpoint, Object attachment, HttpContext context,
+                FutureCallback<AsyncConnectionEndpoint> callback) {
+            delegate.upgrade(endpoint, attachment, context, callback);
+        }
+
+        @Override
+        public void close(CloseMode closeMode) {
+            delegate.close(closeMode);
+        }
+
+        @Override
+        public void close() throws IOException {
+            delegate.close();
+        }
+    }
+
+    static final class HttpClientKey {
+        private final String protocol;
+        private final String authority;
+        private final boolean hasProxy;
+        private final String proxyScheme;
+        private final String proxyHost;
+        private final int proxyPort;
+        private final String proxyUser;
+        private final String proxyPass;
+        private final int connectTimeout;
+        private final DNSCacheManager dnsCacheManager;
+        private final InetAddress localAddress;
+        private final HttpVersionPolicy httpVersionPolicy;
+
+        private HttpClientKey(String protocol, String authority, boolean hasProxy, String proxyScheme,
+                String proxyHost, int proxyPort, String proxyUser, String proxyPass, int connectTimeout, DNSCacheManager dnsCacheManager,
+                InetAddress localAddress, HttpVersionPolicy httpVersionPolicy) {
+            this.protocol = protocol;
+            this.authority = authority;
+            this.hasProxy = hasProxy;
+            this.proxyScheme = proxyScheme;
+            this.proxyHost = proxyHost;
+            this.proxyPort = proxyPort;
+            this.proxyUser = proxyUser;
+            this.proxyPass = proxyPass;
+            this.connectTimeout = connectTimeout;
+            this.dnsCacheManager = dnsCacheManager;
+            this.localAddress = localAddress;
+            this.httpVersionPolicy = httpVersionPolicy;
+        }
+
+        @Override
+        public boolean equals(Object object) {
+            if (this == object) {
+                return true;
+            }
+            if (!(object instanceof HttpClientKey other)) {
+                return false;
+            }
+            return hasProxy == other.hasProxy && proxyPort == other.proxyPort && connectTimeout == other.connectTimeout
+                    && Objects.equals(protocol, other.protocol) && Objects.equals(authority, other.authority)
+                    && Objects.equals(proxyScheme, other.proxyScheme) && Objects.equals(proxyHost, other.proxyHost)
+                    && Objects.equals(proxyUser, other.proxyUser) && Objects.equals(proxyPass, other.proxyPass)
+                    && Objects.equals(dnsCacheManager, other.dnsCacheManager) && Objects.equals(localAddress, other.localAddress)
+                    && httpVersionPolicy == other.httpVersionPolicy;
+        }
+
+        @Override
+        public int hashCode() {
+            return Objects.hash(protocol, authority, hasProxy, proxyScheme, proxyHost, proxyPort, proxyUser, proxyPass, connectTimeout, dnsCacheManager,
+                    localAddress, httpVersionPolicy);
+        }
+    }
+}
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPJavaImpl.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPJavaImpl.java
index 527ed485aad..05301c3c612 100644
--- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPJavaImpl.java
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPJavaImpl.java
@@ -17,22 +17,60 @@
 
 package org.apache.jmeter.protocol.http.sampler;
 
+import java.io.ByteArrayOutputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.Authenticator;
 import java.net.BindException;
 import java.net.HttpURLConnection;
 import java.net.InetSocketAddress;
+import java.net.PasswordAuthentication;
 import java.net.Proxy;
+import java.net.ProxySelector;
+import java.net.URI;
 import java.net.URL;
 import java.net.URLConnection;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
+import java.util.Properties;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.Executor;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ThreadFactory;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.BiFunction;
 import java.util.function.Predicate;
 import java.util.zip.GZIPInputStream;
 
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLContextSpi;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLEngineResult;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLParameters;
+import javax.net.ssl.SSLServerSocketFactory;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSessionContext;
+import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
+
 import org.apache.jmeter.protocol.http.control.AuthManager;
 import org.apache.jmeter.protocol.http.control.Authorization;
 import org.apache.jmeter.protocol.http.control.CacheManager;
@@ -44,6 +82,7 @@
 import org.apache.jmeter.testelement.property.CollectionProperty;
 import org.apache.jmeter.testelement.property.JMeterProperty;
 import org.apache.jmeter.util.JMeterUtils;
+import org.apache.jmeter.util.JsseSSLManager;
 import org.apache.jmeter.util.SSLManager;
 import org.apache.jorphan.io.CountingInputStream;
 import org.apache.jorphan.util.StringUtilities;
@@ -59,8 +98,216 @@ public class HTTPJavaImpl extends HTTPAbstractImpl {
     private static final boolean OBEY_CONTENT_LENGTH =
         JMeterUtils.getPropDefault("httpsampler.obey_contentlength", false); // $NON-NLS-1$
 
+    private static final String DEFAULT_HTTP_VERSION =
+        JMeterUtils.getPropDefault("httpclient.version", HTTPConstants.HTTP_1_1); // $NON-NLS-1$
+
+    /** Name of the {@code User-Agent} request header. */
+    private static final String HEADER_USER_AGENT = "User-Agent"; // $NON-NLS-1$
+
+    /**
+     * {@code User-Agent} of {@link HttpURLConnection}, which is used for HTTP/1.1. JMeter adds it to the
+     * request itself, so it shows up in the sample result and is accounted for in the sent bytes, instead of
+     * being added invisibly by the JDK.
+     */
+    private static final String HTTP_1_DEFAULT_USER_AGENT = createHttp1DefaultUserAgent();
+
+    /** {@code User-Agent} of {@link HttpClient}, which is used for HTTP/2. */
+    private static final String HTTP_2_DEFAULT_USER_AGENT =
+        "Java-http-client/" + System.getProperty("java.version"); // $NON-NLS-1$
+
+    private static String createHttp1DefaultUserAgent() {
+        String javaAgent = "Java/" + System.getProperty("java.version"); // $NON-NLS-1$
+        String agent = System.getProperty("http.agent"); // $NON-NLS-1$
+        return agent == null ? javaAgent : agent + " " + javaAgent;
+    }
+
+    private static final ThreadLocal<Map<HttpClientKey, Http2Client>> HTTP_2_CLIENTS =
+        ThreadLocal.withInitial(ConcurrentHashMap::new);
+
+    /**
+     * HTTP/2 clients used when multiplexing is enabled. The JDK client sends every exchange of a client
+     * over a single connection per origin, so one shared instance lets the requests of all JMeter threads
+     * and of the threads which download embedded resources in parallel share a connection.
+     */
+    private static final Map<HttpClientKey, Http2Client> SHARED_HTTP_2_CLIENTS = new ConcurrentHashMap<>();
+
+    /**
+     * Shared daemon thread pool used by the HTTP/2 {@link HttpClient} instances. It allows JMeter to observe
+     * when a connection has been established, since the client only submits tasks once the TCP connection is up.
+     */
+    private static final ExecutorService HTTP_2_EXECUTOR =
+        Executors.newCachedThreadPool(new Http2ThreadFactory());
+
     private static final Logger log = LoggerFactory.getLogger(HTTPJavaImpl.class);
 
+    /** Multiplex concurrent HTTP/2 message exchanges over a single connection per origin. */
+    private static final boolean HTTP_2_MULTIPLEXING =
+        JMeterUtils.getPropDefault("http.java.h2.multiplexing", true); // $NON-NLS-1$
+
+    /**
+     * Accept HTTP/2 server push. JMeter has no way of reporting pushed resources, so push is switched off
+     * to avoid the server wasting bandwidth on responses that are dropped.
+     */
+    private static final String HTTP_2_PUSH_ENABLED_PROPERTY = "http.java.h2.push_enabled"; // $NON-NLS-1$
+
+    /** System property the JDK client reads to decide whether it announces {@code SETTINGS_ENABLE_PUSH}. */
+    private static final String JDK_PUSH_ENABLED_PROPERTY = "jdk.httpclient.enablepush"; // $NON-NLS-1$
+
+    /**
+     * Maps the JMeter HTTP/2 properties to the {@code jdk.httpclient.*} system properties, which are the only
+     * way to configure the HTTP/2 protocol settings of the JDK client. They are read whenever a client is
+     * built, so they have to be in place before the first HTTP/2 sample is taken.
+     */
+    private static final Map<String, String> HTTP_2_SYSTEM_PROPERTIES = createHttp2SystemPropertyMapping();
+
+    static {
+        applyHttp2SystemProperties(JMeterUtils.getJMeterProperties(), System.getProperties());
+    }
+
+    private static Map<String, String> createHttp2SystemPropertyMapping() {
+        Map<String, String> mapping = new LinkedHashMap<>();
+        // Size of the HPACK dynamic header table announced to the server, 0 disables HPACK indexing
+        mapping.put("http.java.h2.header_table_size", "jdk.httpclient.hpack.maxheadertablesize"); // $NON-NLS-1$ $NON-NLS-2$
+        // Number of server initiated (pushed) streams the client accepts on a connection
+        mapping.put("http.java.h2.max_concurrent_streams", "jdk.httpclient.maxstreams"); // $NON-NLS-1$ $NON-NLS-2$
+        mapping.put("http.java.h2.initial_window_size", "jdk.httpclient.windowsize"); // $NON-NLS-1$ $NON-NLS-2$
+        mapping.put("http.java.h2.connection_window_size", "jdk.httpclient.connectionWindowSize"); // $NON-NLS-1$ $NON-NLS-2$
+        mapping.put("http.java.h2.max_frame_size", "jdk.httpclient.maxframesize"); // $NON-NLS-1$ $NON-NLS-2$
+        mapping.put("http.java.h2.keep_alive_timeout", "jdk.httpclient.keepalive.timeout.h2"); // $NON-NLS-1$ $NON-NLS-2$
+        return Collections.unmodifiableMap(mapping);
+    }
+
+    /**
+     * Copies the HTTP/2 settings from the JMeter properties to the system properties of the JDK client.
+     * Values which are already defined, for example on the command line, are never overwritten.
+     *
+     * @param jmeterProperties the JMeter properties, may be {@code null} when they have not been loaded
+     * @param systemProperties the system properties to configure
+     */
+    static void applyHttp2SystemProperties(Properties jmeterProperties, Properties systemProperties) {
+        Properties source = jmeterProperties != null ? jmeterProperties : new Properties();
+        for (Map.Entry<String, String> entry : HTTP_2_SYSTEM_PROPERTIES.entrySet()) {
+            String value = source.getProperty(entry.getKey());
+            if (StringUtilities.isNotBlank(value)) {
+                setUnlessDefined(systemProperties, entry.getValue(), value.trim());
+            }
+        }
+        boolean pushEnabled = Boolean.parseBoolean(source.getProperty(HTTP_2_PUSH_ENABLED_PROPERTY, "false")); // $NON-NLS-1$
+        setUnlessDefined(systemProperties, JDK_PUSH_ENABLED_PROPERTY, pushEnabled ? "1" : "0"); // $NON-NLS-1$ $NON-NLS-2$
+    }
+
+    private static void setUnlessDefined(Properties systemProperties, String name, String value) {
+        String current = systemProperties.getProperty(name);
+        if (current == null) {
+            systemProperties.setProperty(name, value);
+        } else if (!current.equals(value)) {
+            log.info("Keeping system property {}={}, it takes precedence over the JMeter property", name, current); // $NON-NLS-1$
+        }
+    }
+
+    /**
+     * Returns the HTTP/2 clients of the current thread, or the shared ones when the exchanges of all threads
+     * should be multiplexed over a single connection.
+     *
+     * @return the map the HTTP/2 clients are cached in
+     */
+    static Map<HttpClientKey, Http2Client> getHttp2Clients() {
+        return HTTP_2_MULTIPLEXING ? SHARED_HTTP_2_CLIENTS : HTTP_2_CLIENTS.get();
+    }
+
+    /**
+     * HTTP/2 does not transmit a reason phrase (see RFC 9113, section 8.3.2), so the response message is
+     * derived from the status code. The phrases are the ones registered in the IANA HTTP status code registry.
+     */
+    private static final Map<Integer, String> HTTP_REASON_PHRASES = createReasonPhrases();
+
+    private static Map<Integer, String> createReasonPhrases() {
+        Map<Integer, String> phrases = new HashMap<>();
+        phrases.put(100, "Continue"); // $NON-NLS-1$
+        phrases.put(101, "Switching Protocols"); // $NON-NLS-1$
+        phrases.put(102, "Processing"); // $NON-NLS-1$
+        phrases.put(103, "Early Hints"); // $NON-NLS-1$
+        phrases.put(200, "OK"); // $NON-NLS-1$
+        phrases.put(201, "Created"); // $NON-NLS-1$
+        phrases.put(202, "Accepted"); // $NON-NLS-1$
+        phrases.put(203, "Non-Authoritative Information"); // $NON-NLS-1$
+        phrases.put(204, "No Content"); // $NON-NLS-1$
+        phrases.put(205, "Reset Content"); // $NON-NLS-1$
+        phrases.put(206, "Partial Content"); // $NON-NLS-1$
+        phrases.put(207, "Multi-Status"); // $NON-NLS-1$
+        phrases.put(208, "Already Reported"); // $NON-NLS-1$
+        phrases.put(226, "IM Used"); // $NON-NLS-1$
+        phrases.put(300, "Multiple Choices"); // $NON-NLS-1$
+        phrases.put(301, "Moved Permanently"); // $NON-NLS-1$
+        phrases.put(302, "Found"); // $NON-NLS-1$
+        phrases.put(303, "See Other"); // $NON-NLS-1$
+        phrases.put(304, "Not Modified"); // $NON-NLS-1$
+        phrases.put(305, "Use Proxy"); // $NON-NLS-1$
+        phrases.put(307, "Temporary Redirect"); // $NON-NLS-1$
+        phrases.put(308, "Permanent Redirect"); // $NON-NLS-1$
+        phrases.put(400, "Bad Request"); // $NON-NLS-1$
+        phrases.put(401, "Unauthorized"); // $NON-NLS-1$
+        phrases.put(402, "Payment Required"); // $NON-NLS-1$
+        phrases.put(403, "Forbidden"); // $NON-NLS-1$
+        phrases.put(404, "Not Found"); // $NON-NLS-1$
+        phrases.put(405, "Method Not Allowed"); // $NON-NLS-1$
+        phrases.put(406, "Not Acceptable"); // $NON-NLS-1$
+        phrases.put(407, "Proxy Authentication Required"); // $NON-NLS-1$
+        phrases.put(408, "Request Timeout"); // $NON-NLS-1$
+        phrases.put(409, "Conflict"); // $NON-NLS-1$
+        phrases.put(410, "Gone"); // $NON-NLS-1$
+        phrases.put(411, "Length Required"); // $NON-NLS-1$
+        phrases.put(412, "Precondition Failed"); // $NON-NLS-1$
+        phrases.put(413, "Content Too Large"); // $NON-NLS-1$
+        phrases.put(414, "URI Too Long"); // $NON-NLS-1$
+        phrases.put(415, "Unsupported Media Type"); // $NON-NLS-1$
+        phrases.put(416, "Range Not Satisfiable"); // $NON-NLS-1$
+        phrases.put(417, "Expectation Failed"); // $NON-NLS-1$
+        phrases.put(421, "Misdirected Request"); // $NON-NLS-1$
+        phrases.put(422, "Unprocessable Content"); // $NON-NLS-1$
+        phrases.put(423, "Locked"); // $NON-NLS-1$
+        phrases.put(424, "Failed Dependency"); // $NON-NLS-1$
+        phrases.put(425, "Too Early"); // $NON-NLS-1$
+        phrases.put(426, "Upgrade Required"); // $NON-NLS-1$
+        phrases.put(428, "Precondition Required"); // $NON-NLS-1$
+        phrases.put(429, "Too Many Requests"); // $NON-NLS-1$
+        phrases.put(431, "Request Header Fields Too Large"); // $NON-NLS-1$
+        phrases.put(451, "Unavailable For Legal Reasons"); // $NON-NLS-1$
+        phrases.put(500, "Internal Server Error"); // $NON-NLS-1$
+        phrases.put(501, "Not Implemented"); // $NON-NLS-1$
+        phrases.put(502, "Bad Gateway"); // $NON-NLS-1$
+        phrases.put(503, "Service Unavailable"); // $NON-NLS-1$
+        phrases.put(504, "Gateway Timeout"); // $NON-NLS-1$
+        phrases.put(505, "HTTP Version Not Supported"); // $NON-NLS-1$
+        phrases.put(506, "Variant Also Negotiates"); // $NON-NLS-1$
+        phrases.put(507, "Insufficient Storage"); // $NON-NLS-1$
+        phrases.put(508, "Loop Detected"); // $NON-NLS-1$
+        phrases.put(510, "Not Extended"); // $NON-NLS-1$
+        phrases.put(511, "Network Authentication Required"); // $NON-NLS-1$
+        return Collections.unmodifiableMap(phrases);
+    }
+
+    /**
+     * Returns the reason phrase belonging to the given HTTP status code.
+     *
+     * @param statusCode the HTTP status code
+     * @return the registered reason phrase, or an empty string if the status code is unknown
+     */
+    static String getReasonPhrase(int statusCode) {
+        return HTTP_REASON_PHRASES.getOrDefault(statusCode, ""); // $NON-NLS-1$
+    }
+
+    static boolean isHttp2(String samplerHttpVersion, String defaultHttpVersion) {
+        String httpVersion = StringUtilities.isBlank(samplerHttpVersion) ? defaultHttpVersion : samplerHttpVersion;
+        // java.net.http.HttpClient always negotiates, so a strict HTTP/2 request is negotiated as well
+        return HTTPConstants.HTTP_VERSION_2.equalsIgnoreCase(httpVersion) || "2".equalsIgnoreCase(httpVersion)
+                || HTTPConstants.HTTP_VERSION_2_STRICT.equalsIgnoreCase(httpVersion); // $NON-NLS-1$
+    }
+
+    private boolean isHttp2() {
+        return isHttp2(testElement.getHttpVersion(), DEFAULT_HTTP_VERSION);
+    }
+
     private static final int MAX_CONN_RETRIES =
         JMeterUtils.getPropDefault("http.java.sampler.retries" // $NON-NLS-1$
                 ,0); // Maximum connection retries
@@ -191,10 +438,11 @@ protected HttpURLConnection setupConnection(URL u, String method, HTTPSampleResu
         }
 
         conn.setRequestMethod(method);
-        setConnectionHeaders(conn, u, getHeaderManager(), getCacheManager());
+        Map<String, String> securityHeaders = setConnectionHeaders(conn, u, getHeaderManager(), getCacheManager());
         String cookies = setConnectionCookie(conn, u, getCookieManager());
 
-        Map<String, String> securityHeaders = setConnectionAuthorization(conn, u, getAuthManager());
+        setConnectionAuthorization(conn, u, getAuthManager(), securityHeaders);
+        setDefaultUserAgent(conn, HTTP_1_DEFAULT_USER_AGENT);
 
         if (method.equals(HTTPConstants.POST)) {
             setPostHeaders(conn);
@@ -348,6 +596,11 @@ private static String setConnectionCookie(HttpURLConnection conn, URL u, CookieM
         return cookieHeader;
     }
 
+    private static boolean isSecurityHeader(String name) {
+        return name != null && (HTTPConstants.HEADER_AUTHORIZATION.equalsIgnoreCase(name)
+                || "Proxy-Authorization".equalsIgnoreCase(name));
+    }
+
     /**
      * Extracts all the required headers for that particular URL request and
      * sets them in the <code>HttpURLConnection</code> passed in
@@ -361,11 +614,13 @@ private static String setConnectionCookie(HttpURLConnection conn, URL u, CookieM
      *            the <code>HeaderManager</code> containing all the cookies
      *            for this <code>UrlConfig</code>
      * @param cacheManager the CacheManager (may be null)
+     * @return Map of security headers set from HeaderManager
      */
-    private static void setConnectionHeaders(HttpURLConnection conn, URL u,
+    private static Map<String, String> setConnectionHeaders(HttpURLConnection conn, URL u,
             HeaderManager headerManager, CacheManager cacheManager) {
         // Add all the headers from the HeaderManager
         Header[] arrayOfHeaders = null;
+        Map<String, String> securityHeaders = new LinkedHashMap<>();
         if (headerManager != null) {
             CollectionProperty headers = headerManager.getHeaders();
             if (headers != null) {
@@ -377,12 +632,16 @@ private static void setConnectionHeaders(HttpURLConnection conn, URL u,
                     String v = header.getValue();
                     arrayOfHeaders[i++] = header;
                     conn.addRequestProperty(n, v);
+                    if (isSecurityHeader(n)) {
+                        securityHeaders.put(n, v);
+                    }
                 }
             }
         }
         if (cacheManager != null){
             cacheManager.setHeaders(conn, arrayOfHeaders, u);
         }
+        return securityHeaders;
     }
 
     /**
@@ -445,13 +704,28 @@ private static String getFromConnectionHeaders(HttpURLConnection conn, Map<Strin
         }
         if(addSecurityHeaders) {
             for(Map.Entry<String, String> entry : securityHeaders.entrySet()) {
-                hdrs.append(entry.getKey()).append(": ") // $NON-NLS-1$
-                    .append(entry.getValue()).append("\n"); // $NON-NLS-1$
+                if (!hasHeader(requestHeaders, entry.getKey())) {
+                    hdrs.append(entry.getKey()).append(": ") // $NON-NLS-1$
+                        .append(entry.getValue()).append("\n"); // $NON-NLS-1$
+                }
             }
         }
         return hdrs.toString();
     }
 
+    /**
+     * Adds the {@code User-Agent} the JDK would add on its own, so it is visible in the sample result and
+     * counted in the sent bytes. Nothing is added when the test plan defines a {@code User-Agent} itself.
+     *
+     * @param conn connection the header is added to
+     * @param defaultUserAgent {@code User-Agent} used when the request has none
+     */
+    private static void setDefaultUserAgent(HttpURLConnection conn, String defaultUserAgent) {
+        if (conn.getRequestProperty(HEADER_USER_AGENT) == null) {
+            conn.setRequestProperty(HEADER_USER_AGENT, defaultUserAgent);
+        }
+    }
+
     /**
      * Extracts all the required authorization for that particular URL request
      * and sets it in the <code>HttpURLConnection</code> passed in.
@@ -464,9 +738,10 @@ private static String getFromConnectionHeaders(HttpURLConnection conn, Map<Strin
      * @param authManager
      *            the <code>AuthManager</code> containing all the cookies for
      *            this <code>UrlConfig</code>
-     * @return String Authorization header value or null if not set
+     * @param securityHeaders
+     *            Map to collect security headers
      */
-    private static Map<String, String> setConnectionAuthorization(HttpURLConnection conn, URL u, AuthManager authManager) {
+    private static void setConnectionAuthorization(HttpURLConnection conn, URL u, AuthManager authManager, Map<String, String> securityHeaders) {
         if (authManager != null) {
             Authorization auth = authManager.getAuthForURL(u);
             if (auth != null) {
@@ -474,10 +749,9 @@ private static Map<String, String> setConnectionAuthorization(HttpURLConnection
                 conn.setRequestProperty(HTTPConstants.HEADER_AUTHORIZATION, headerValue);
                 // Java hides request properties so we have to
                 // keep trace of it
-                return Collections.singletonMap(HTTPConstants.HEADER_AUTHORIZATION, headerValue);
+                securityHeaders.put(HTTPConstants.HEADER_AUTHORIZATION, headerValue);
             }
         }
-        return Collections.emptyMap();
     }
 
     /**
@@ -501,6 +775,9 @@ private static Map<String, String> setConnectionAuthorization(HttpURLConnection
      */
     @Override
     protected HTTPSampleResult sample(URL url, String method, boolean areFollowingRedirect, int frameDepth) {
+        if (isHttp2()) {
+            return sampleHttp2(url, method, areFollowingRedirect, frameDepth);
+        }
         HttpURLConnection conn = null;
 
         String urlStr = url.toString();
@@ -524,6 +801,10 @@ protected HTTPSampleResult sample(URL url, String method, boolean areFollowingRe
            }
         }
 
+        Map<String, List<String>> requestHeaders = null;
+        Map<String, String> securityHeaders = Collections.emptyMap();
+        byte[] postBodyBytes = null;
+
         try {
             // Sampling proper - establish the connection and read the response:
             // Repeatedly try to connect:
@@ -532,9 +813,13 @@ protected HTTPSampleResult sample(URL url, String method, boolean areFollowingRe
             for (; retry < MAX_CONN_RETRIES; retry++) {
                 try {
                     conn = setupConnection(url, method, res);
+                    requestHeaders = new LinkedHashMap<>(conn.getRequestProperties());
+                    securityHeaders = setConnectionHeaders(conn, url, getHeaderManager(), getCacheManager());
+                    setConnectionAuthorization(conn, url, getAuthManager(), securityHeaders);
                     // Attempt the connection:
                     savedConn = conn;
                     conn.connect();
+                    res.connectEnd();
                     break;
                 } catch (BindException e) {
                     if (retry >= MAX_CONN_RETRIES) {
@@ -560,9 +845,15 @@ protected HTTPSampleResult sample(URL url, String method, boolean areFollowingRe
             if (method.equals(HTTPConstants.POST)) {
                 String postBody = sendPostData(conn);
                 res.setQueryString(postBody);
+                if (postBody != null) {
+                    postBodyBytes = getBytes(postBody);
+                }
             } else if (method.equals(HTTPConstants.PUT)) {
                 String putBody = sendPutData(conn);
                 res.setQueryString(putBody);
+                if (putBody != null) {
+                    postBodyBytes = getBytes(putBody);
+                }
             }
             // Request sent. Now get the response:
             byte[] responseData = readResponse(conn, res);
@@ -644,6 +935,8 @@ protected HTTPSampleResult sample(URL url, String method, boolean areFollowingRe
                 cacheManager.saveDetails(conn, res);
             }
 
+            res.setSentBytes(calculateSentBytes(url, method, testElement.getHttpVersion(), requestHeaders, securityHeaders, postBodyBytes));
+
             res = resultProcessing(areFollowingRedirect, frameDepth, res);
 
             log.debug("End : sample");
@@ -652,6 +945,7 @@ protected HTTPSampleResult sample(URL url, String method, boolean areFollowingRe
             if (res.getEndTime() == 0) {
                 res.sampleEnd();
             }
+            res.setSentBytes(calculateSentBytes(url, method, testElement.getHttpVersion(), requestHeaders, securityHeaders, postBodyBytes));
             savedConn = null; // we don't want interrupt to try disconnection again
             // We don't want to continue using this connection, even if KeepAlive is set
             if (conn != null) { // May not exist
@@ -726,4 +1020,884 @@ public boolean interrupt() {
         }
         return conn != null;
     }
+
+    private HTTPSampleResult sampleHttp2(URL url, String method, boolean areFollowingRedirect, int frameDepth) {
+        if (log.isDebugEnabled()) {
+            log.debug("Start : sampleHttp2 {}, method {}, followingRedirect {}, depth {}",
+                    url, method, areFollowingRedirect, frameDepth);
+        }
+
+        HTTPSampleResult res = new HTTPSampleResult();
+        configureSampleLabel(res, url);
+        res.setURL(url);
+        res.setHTTPMethod(method);
+
+        res.sampleStart();
+
+        final CacheManager cacheManager = getCacheManager();
+        if (cacheManager != null && HTTPConstants.GET.equalsIgnoreCase(method)) {
+            if (cacheManager.inCache(url, getHeaders(getHeaderManager()))) {
+                return updateSampleResultForResourceInCache(res);
+            }
+        }
+
+        CapturingHttpURLConnection capturingConn = null;
+        byte[] requestBodyBytes = new byte[0];
+        Map<String, String> securityHeaders = Collections.emptyMap();
+
+        try {
+            capturingConn = new CapturingHttpURLConnection(url, method);
+
+            securityHeaders = setConnectionHeaders(capturingConn, url, getHeaderManager(), getCacheManager());
+            String cookies = setConnectionCookie(capturingConn, url, getCookieManager());
+            setConnectionAuthorization(capturingConn, url, getAuthManager(), securityHeaders);
+            setDefaultUserAgent(capturingConn, HTTP_2_DEFAULT_USER_AGENT);
+
+            if (method.equals(HTTPConstants.POST)) {
+                setPostHeaders(capturingConn);
+                String postBody = sendPostData(capturingConn);
+                res.setQueryString(postBody);
+                requestBodyBytes = capturingConn.getCapturedBytes();
+            } else if (method.equals(HTTPConstants.PUT)) {
+                setPutHeaders(capturingConn);
+                String putBody = sendPutData(capturingConn);
+                res.setQueryString(putBody);
+                requestBodyBytes = capturingConn.getCapturedBytes();
+            }
+
+            res.setRequestHeaders(getAllHeadersExceptCookie(capturingConn, securityHeaders));
+            if (StringUtilities.isNotEmpty(cookies)) {
+                res.setCookies(cookies);
+            } else {
+                res.setCookies(getOnlyCookieFromHeaders(capturingConn, securityHeaders));
+            }
+
+            URI uri = url.toURI();
+            HttpRequest.Builder reqBuilder = HttpRequest.newBuilder(uri);
+
+            if (method.equalsIgnoreCase(HTTPConstants.POST) || method.equalsIgnoreCase(HTTPConstants.PUT)
+                    || method.equalsIgnoreCase(HTTPConstants.PATCH)) {
+                reqBuilder.method(method, HttpRequest.BodyPublishers.ofByteArray(requestBodyBytes));
+            } else if (method.equalsIgnoreCase(HTTPConstants.GET)) {
+                reqBuilder.GET();
+            } else if (method.equalsIgnoreCase(HTTPConstants.DELETE)) {
+                reqBuilder.DELETE();
+            } else {
+                reqBuilder.method(method, HttpRequest.BodyPublishers.noBody());
+            }
+
+            int rto = getResponseTimeout();
+            if (rto > 0) {
+                reqBuilder.timeout(Duration.ofMillis(rto));
+            }
+
+            Map<String, List<String>> props = capturingConn.getRequestProperties();
+            for (Map.Entry<String, List<String>> entry : props.entrySet()) {
+                String headerName = entry.getKey();
+                if (headerName == null || isRestrictedHeader(headerName)) {
+                    continue;
+                }
+                for (String value : entry.getValue()) {
+                    reqBuilder.header(headerName, value);
+                }
+            }
+
+            Http2Client client = getHttpClient(url);
+            HttpRequest httpRequest = reqBuilder.build();
+
+            HttpResponse<InputStream> response;
+            ConnectTimeTracker connectTimeTracker = client.connectTimeTracker;
+            connectTimeTracker.sampleStarted(res);
+            try {
+                response = client.httpClient.send(httpRequest, HttpResponse.BodyHandlers.ofInputStream());
+            } finally {
+                connectTimeTracker.sampleFinished(res);
+            }
+            res.latencyEnd();
+
+            byte[] responseData = readResponse(response, res);
+
+            res.sampleEnd();
+
+            res.setResponseData(responseData);
+
+            int statusCode = response.statusCode();
+            res.setResponseCode(Integer.toString(statusCode));
+            res.setSuccessful(isSuccessCode(statusCode));
+            res.setResponseMessage(getReasonPhrase(statusCode));
+
+            String responseHeaders = getResponseHeaders(response);
+            res.setResponseHeaders(responseHeaders);
+
+            String ct = response.headers().firstValue(HTTPConstants.HEADER_CONTENT_TYPE).orElse(null);
+            if (ct != null) {
+                res.setContentType(ct);
+                res.setEncodingAndType(ct);
+            }
+
+            if (res.isRedirect()) {
+                String location = response.headers().firstValue(HTTPConstants.HEADER_LOCATION).orElse(null);
+                if (location != null) {
+                    res.setRedirectLocation(location);
+                }
+            }
+
+            res.setHeadersSize(
+                    responseHeaders.length()
+                            + StringUtilities.count(responseHeaders, '\n')
+                            + 2);
+
+            if (getAutoRedirects()) {
+                res.setURL(response.uri().toURL());
+            }
+
+            saveConnectionCookies(response, url, getCookieManager());
+
+            if (cacheManager != null) {
+                cacheManager.saveDetails(response, res);
+            }
+
+            res.setSentBytes(calculateSentBytes(url, method, "HTTP/2",
+                    capturingConn != null ? capturingConn.getRequestProperties() : null,
+                    securityHeaders, requestBodyBytes));
+
+            res = resultProcessing(areFollowingRedirect, frameDepth, res);
+
+            log.debug("End : sampleHttp2");
+            return res;
+        } catch (Exception e) {
+            if (res.getEndTime() == 0) {
+                res.sampleEnd();
+            }
+            res.setSentBytes(calculateSentBytes(url, method, "HTTP/2",
+                    capturingConn != null ? capturingConn.getRequestProperties() : null,
+                    securityHeaders, requestBodyBytes));
+            return errorResult(e, res);
+        }
+    }
+
+    private byte[] readResponse(HttpResponse<InputStream> response, SampleResult res) throws IOException {
+        InputStream in = response.body();
+        if (in == null) {
+            return NULL_BA;
+        }
+
+        boolean gzipped = response.headers().firstValue(HTTPConstants.HEADER_CONTENT_ENCODING)
+                .map(HTTPConstants.ENCODING_GZIP::equalsIgnoreCase)
+                .orElse(false);
+
+        long contentLength = response.headers().firstValueAsLong(HTTPConstants.HEADER_CONTENT_LENGTH).orElse(-1L);
+
+        if (contentLength == 0 && OBEY_CONTENT_LENGTH) {
+            log.info("Content-Length: 0, not reading http-body");
+            res.setResponseHeaders(getResponseHeaders(response));
+            res.latencyEnd();
+            return NULL_BA;
+        }
+
+        CountingInputStream instream = new CountingInputStream(in);
+        InputStream stream = gzipped ? new GZIPInputStream(instream) : instream;
+
+        try {
+            byte[] responseData = readResponse(res, stream, contentLength);
+            res.setBodySize(instream.getBytesRead());
+            return responseData;
+        } finally {
+            instream.close();
+        }
+    }
+
+    private static String getResponseHeaders(HttpResponse<?> response) {
+        StringBuilder headerBuf = new StringBuilder();
+        String versionStr = (response.version() == HttpClient.Version.HTTP_2) ? "HTTP/2" : "HTTP/1.1"; // $NON-NLS-1$ $NON-NLS-2$
+        headerBuf.append(versionStr).append(" ").append(response.statusCode()).append("\n"); // $NON-NLS-1$ $NON-NLS-2$
+
+        response.headers().map().forEach((key, values) -> {
+            if (key != null) {
+                for (String val : values) {
+                    headerBuf.append(key).append(": ").append(val).append("\n"); // $NON-NLS-1$ $NON-NLS-2$
+                }
+            }
+        });
+        return headerBuf.toString();
+    }
+
+    private static void saveConnectionCookies(HttpResponse<?> response, URL u, CookieManager cookieManager) {
+        if (cookieManager != null) {
+            List<String> setCookies = response.headers().allValues(HTTPConstants.HEADER_SET_COOKIE);
+            for (String setCookie : setCookies) {
+                cookieManager.addCookieFromHeader(setCookie, u);
+            }
+        }
+    }
+
+    private static boolean isRestrictedHeader(String name) {
+        return HTTPConstants.HEADER_CONNECTION.equalsIgnoreCase(name)
+                || HTTPConstants.HEADER_CONTENT_LENGTH.equalsIgnoreCase(name)
+                || "Host".equalsIgnoreCase(name) // $NON-NLS-1$
+                || "Expect".equalsIgnoreCase(name) // $NON-NLS-1$
+                || "Upgrade".equalsIgnoreCase(name); // $NON-NLS-1$
+    }
+
+    private static long calculateSentBytes(
+            URL u,
+            String method,
+            String version,
+            Map<String, List<String>> requestHeaders,
+            Map<String, String> securityHeaders,
+            byte[] postBodyBytes) {
+        long sentBytes = 0;
+
+        if (StringUtilities.isBlank(method)) {
+            method = HTTPConstants.GET;
+        }
+
+        String uri = u != null ? u.getFile() : "";
+        if (StringUtilities.isBlank(uri)) {
+            uri = "/"; // $NON-NLS-1$
+        }
+
+        if (StringUtilities.isBlank(version)) {
+            version = HTTPConstants.HTTP_1_1;
+        }
+
+        // Request line: METHOD URI VERSION\r\n
+        sentBytes += method.getBytes(StandardCharsets.UTF_8).length;
+        sentBytes += 1;
+        sentBytes += uri.getBytes(StandardCharsets.UTF_8).length;
+        sentBytes += 1;
+        sentBytes += version.getBytes(StandardCharsets.UTF_8).length;
+        sentBytes += 2;
+
+        // Request headers
+        if (requestHeaders != null) {
+            for (Map.Entry<String, List<String>> entry : requestHeaders.entrySet()) {
+                String key = entry.getKey();
+                if (key != null) {
+                    List<String> values = entry.getValue();
+                    if (values != null) {
+                        for (String val : values) {
+                            sentBytes += key.getBytes(StandardCharsets.UTF_8).length;
+                            sentBytes += 2; // ": "
+                            if (val != null) {
+                                sentBytes += val.getBytes(StandardCharsets.UTF_8).length;
+                            }
+                            sentBytes += 2; // "\r\n"
+                        }
+                    }
+                }
+            }
+        }
+
+        if (securityHeaders != null && !securityHeaders.isEmpty()) {
+            for (Map.Entry<String, String> secEntry : securityHeaders.entrySet()) {
+                String secKey = secEntry.getKey();
+                String secVal = secEntry.getValue();
+                if (secKey != null && !hasHeader(requestHeaders, secKey)) {
+                    sentBytes += secKey.getBytes(StandardCharsets.UTF_8).length;
+                    sentBytes += 2; // ": "
+                    if (secVal != null) {
+                        sentBytes += secVal.getBytes(StandardCharsets.UTF_8).length;
+                    }
+                    sentBytes += 2; // "\r\n"
+                }
+            }
+        }
+
+        // Header/Body separator \r\n
+        sentBytes += 2;
+
+        // Request body
+        if (postBodyBytes != null && postBodyBytes.length > 0) {
+            sentBytes += postBodyBytes.length;
+        } else if (requestHeaders != null) {
+            String contentLengthStr = getHeaderValue(requestHeaders, HTTPConstants.HEADER_CONTENT_LENGTH);
+            if (StringUtilities.isNotEmpty(contentLengthStr)) {
+                try {
+                    sentBytes += Long.parseLong(contentLengthStr);
+                } catch (NumberFormatException e) {
+                    log.debug("Could not parse Content-Length header: {}", contentLengthStr, e);
+                }
+            }
+        }
+
+        return sentBytes;
+    }
+
+    private static boolean hasHeader(Map<String, List<String>> headers, String headerName) {
+        if (headers == null || headerName == null) {
+            return false;
+        }
+        for (String key : headers.keySet()) {
+            if (headerName.equalsIgnoreCase(key)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static String getHeaderValue(Map<String, List<String>> headers, String headerName) {
+        if (headers == null || headerName == null) {
+            return null;
+        }
+        for (Map.Entry<String, List<String>> entry : headers.entrySet()) {
+            if (headerName.equalsIgnoreCase(entry.getKey())) {
+                List<String> values = entry.getValue();
+                if (values != null && !values.isEmpty()) {
+                    return values.get(0);
+                }
+            }
+        }
+        return null;
+    }
+
+    private byte[] getBytes(String postBody) {
+        String enc = testElement != null ? testElement.getContentEncoding() : null;
+        if (StringUtilities.isBlank(enc)) {
+            enc = StandardCharsets.UTF_8.name();
+        }
+        try {
+            return postBody.getBytes(enc);
+        } catch (Exception e) {
+            return postBody.getBytes(StandardCharsets.UTF_8);
+        }
+    }
+
+    private Http2Client getHttpClient(URL url) {
+        int connectTimeout = getConnectTimeout();
+        String proxyHost = getProxyHost();
+        int proxyPort = getProxyPortInt();
+        String proxyUser = getProxyUser();
+        String proxyPass = getProxyPass();
+        boolean autoRedirects = getAutoRedirects();
+        SSLContext sslContext = null;
+
+        if (HTTPConstants.PROTOCOL_HTTPS.equalsIgnoreCase(url.getProtocol())) {
+            try {
+                SSLManager sslmgr = SSLManager.getInstance();
+                if (sslmgr instanceof JsseSSLManager jsseSSLManager) {
+                    sslContext = jsseSSLManager.getContext();
+                }
+            } catch (Exception e) {
+                log.warn("Problem getting SSLContext for HTTP/2 HttpClient: ", e); // $NON-NLS-1$
+            }
+            if (sslContext == null) {
+                // Use the default context explicitly, so the connect time of the TLS handshake can be measured
+                try {
+                    sslContext = SSLContext.getDefault();
+                } catch (NoSuchAlgorithmException e) {
+                    log.warn("Problem getting default SSLContext for HTTP/2 HttpClient: ", e); // $NON-NLS-1$
+                }
+            }
+        }
+
+        HttpClientKey key = new HttpClientKey(connectTimeout, proxyHost, proxyPort,
+                proxyUser, proxyPass, autoRedirects, sslContext);
+
+        return getHttp2Clients().computeIfAbsent(key, HTTPJavaImpl::createHttpClient);
+    }
+
+    private static Http2Client createHttpClient(HttpClientKey key) {
+        ConnectTimeTracker connectTimeTracker = new ConnectTimeTracker();
+        HttpClient.Builder builder = HttpClient.newBuilder()
+                .version(HttpClient.Version.HTTP_2)
+                .executor(new ConnectTimeMeasuringExecutor(connectTimeTracker))
+                .followRedirects(key.autoRedirects ? HttpClient.Redirect.NORMAL : HttpClient.Redirect.NEVER);
+
+        if (key.connectTimeout > 0) {
+            builder.connectTimeout(Duration.ofMillis(key.connectTimeout));
+        }
+
+        if (StringUtilities.isNotEmpty(key.proxyHost) && key.proxyPort > 0) {
+            builder.proxy(ProxySelector.of(new InetSocketAddress(key.proxyHost, key.proxyPort)));
+            if (StringUtilities.isNotEmpty(key.proxyUser)) {
+                builder.authenticator(new Authenticator() {
+                    @Override
+                    protected PasswordAuthentication getPasswordAuthentication() {
+                        if (getRequestorType() == RequestorType.PROXY) {
+                            return new PasswordAuthentication(key.proxyUser,
+                                    key.proxyPass != null ? key.proxyPass.toCharArray() : new char[0]);
+                        }
+                        return super.getPasswordAuthentication();
+                    }
+                });
+            }
+        }
+
+        if (key.sslContext != null) {
+            builder.sslContext(new ConnectTimeMeasuringSSLContext(key.sslContext, connectTimeTracker));
+        }
+
+        return new Http2Client(builder.build(), connectTimeTracker);
+    }
+
+    /**
+     * Holder for an HTTP/2 {@link HttpClient} and the tracker which measures the connect time of its connections.
+     */
+    private static final class Http2Client {
+        private final HttpClient httpClient;
+        private final ConnectTimeTracker connectTimeTracker;
+
+        Http2Client(HttpClient httpClient, ConnectTimeTracker connectTimeTracker) {
+            this.httpClient = httpClient;
+            this.connectTimeTracker = connectTimeTracker;
+        }
+    }
+
+    /**
+     * Records the connect time of the JDK {@link HttpClient} in the {@link SampleResult}s which are in flight.
+     * <p>
+     * The JDK client does not expose a hook for connection establishment, so two indicators are used:
+     * the client submits its first task to the executor once the TCP connection has been established, and
+     * the wrapped {@code SSLEngine} reports when the TLS handshake has been finished. The TLS handshake
+     * always wins, since it is the more precise and the later event.
+     * <p>
+     * A multiplexed client is shared by several threads, so more than one sample can be in flight. Since the
+     * connection is established for all of them at once, the connect time is recorded in every sample which
+     * is waiting for it.
+     */
+    static final class ConnectTimeTracker {
+        private static final Integer NOTHING_RECORDED = 0;
+        private static final Integer CONNECT_RECORDED = 1;
+        private static final Integer HANDSHAKE_RECORDED = 2;
+
+        /** Samples which are currently in flight, together with the connect event recorded for them. */
+        private final Map<SampleResult, Integer> activeSamples = new ConcurrentHashMap<>();
+
+        void sampleStarted(SampleResult result) {
+            activeSamples.put(result, NOTHING_RECORDED);
+        }
+
+        void sampleFinished(SampleResult result) {
+            activeSamples.remove(result);
+        }
+
+        /** Invoked when the TCP connection has been established. */
+        void connectionEstablished() {
+            recordConnectEnd(CONNECT_RECORDED);
+        }
+
+        /** Invoked when the TLS handshake has been finished, it overrides the plain TCP connect time. */
+        void handshakeFinished() {
+            recordConnectEnd(HANDSHAKE_RECORDED);
+        }
+
+        private void recordConnectEnd(Integer event) {
+            activeSamples.replaceAll((result, recorded) -> {
+                if (recorded.intValue() >= event.intValue()) {
+                    return recorded;
+                }
+                result.connectEnd();
+                return event;
+            });
+        }
+    }
+
+    /**
+     * Executor which notifies the {@link ConnectTimeTracker} before delegating to the shared thread pool.
+     */
+    private static final class ConnectTimeMeasuringExecutor implements Executor {
+        private final ConnectTimeTracker tracker;
+
+        ConnectTimeMeasuringExecutor(ConnectTimeTracker tracker) {
+            this.tracker = tracker;
+        }
+
+        @Override
+        public void execute(Runnable command) {
+            tracker.connectionEstablished();
+            HTTP_2_EXECUTOR.execute(command);
+        }
+    }
+
+    private static final class Http2ThreadFactory implements ThreadFactory {
+        private final AtomicInteger counter = new AtomicInteger();
+
+        @Override
+        public Thread newThread(Runnable r) {
+            Thread thread = new Thread(r, "JMeter-HTTP2-" + counter.incrementAndGet()); // $NON-NLS-1$
+            thread.setDaemon(true);
+            return thread;
+        }
+    }
+
+    /**
+     * {@link SSLContext} which creates {@link SSLEngine}s that report the end of the TLS handshake.
+     */
+    static final class ConnectTimeMeasuringSSLContext extends SSLContext {
+        ConnectTimeMeasuringSSLContext(SSLContext delegate, ConnectTimeTracker tracker) {
+            super(new ConnectTimeMeasuringSSLContextSpi(delegate, tracker), delegate.getProvider(),
+                    delegate.getProtocol());
+        }
+    }
+
+    private static final class ConnectTimeMeasuringSSLContextSpi extends SSLContextSpi {
+        private final SSLContext delegate;
+        private final ConnectTimeTracker tracker;
+
+        ConnectTimeMeasuringSSLContextSpi(SSLContext delegate, ConnectTimeTracker tracker) {
+            this.delegate = delegate;
+            this.tracker = tracker;
+        }
+
+        @Override
+        protected void engineInit(KeyManager[] km, TrustManager[] tm, SecureRandom sr) throws KeyManagementException {
+            delegate.init(km, tm, sr);
+        }
+
+        @Override
+        protected SSLSocketFactory engineGetSocketFactory() {
+            return delegate.getSocketFactory();
+        }
+
+        @Override
+        protected SSLServerSocketFactory engineGetServerSocketFactory() {
+            return delegate.getServerSocketFactory();
+        }
+
+        @Override
+        protected SSLEngine engineCreateSSLEngine() {
+            return new ConnectTimeMeasuringSSLEngine(delegate.createSSLEngine(), tracker);
+        }
+
+        @Override
+        protected SSLEngine engineCreateSSLEngine(String host, int port) {
+            return new ConnectTimeMeasuringSSLEngine(delegate.createSSLEngine(host, port), tracker);
+        }
+
+        @Override
+        protected SSLSessionContext engineGetServerSessionContext() {
+            return delegate.getServerSessionContext();
+        }
+
+        @Override
+        protected SSLSessionContext engineGetClientSessionContext() {
+            return delegate.getClientSessionContext();
+        }
+
+        @Override
+        protected SSLParameters engineGetDefaultSSLParameters() {
+            return delegate.getDefaultSSLParameters();
+        }
+
+        @Override
+        protected SSLParameters engineGetSupportedSSLParameters() {
+            return delegate.getSupportedSSLParameters();
+        }
+    }
+
+    /**
+     * {@link SSLEngine} which delegates all calls and notifies the {@link ConnectTimeTracker}
+     * as soon as the TLS handshake has been finished.
+     */
+    static final class ConnectTimeMeasuringSSLEngine extends SSLEngine {
+        private final SSLEngine delegate;
+        private final ConnectTimeTracker tracker;
+
+        ConnectTimeMeasuringSSLEngine(SSLEngine delegate, ConnectTimeTracker tracker) {
+            super(delegate.getPeerHost(), delegate.getPeerPort());
+            this.delegate = delegate;
+            this.tracker = tracker;
+        }
+
+        private void checkHandshakeFinished(SSLEngineResult result) {
+            if (result.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.FINISHED) {
+                tracker.handshakeFinished();
+            }
+        }
+
+        @Override
+        public SSLEngineResult wrap(ByteBuffer[] srcs, int offset, int length, ByteBuffer dst) throws SSLException {
+            SSLEngineResult result = delegate.wrap(srcs, offset, length, dst);
+            checkHandshakeFinished(result);
+            return result;
+        }
+
+        @Override
+        public SSLEngineResult unwrap(ByteBuffer src, ByteBuffer[] dsts, int offset, int length) throws SSLException {
+            SSLEngineResult result = delegate.unwrap(src, dsts, offset, length);
+            checkHandshakeFinished(result);
+            return result;
+        }
+
+        @Override
+        public Runnable getDelegatedTask() {
+            return delegate.getDelegatedTask();
+        }
+
+        @Override
+        public void closeInbound() throws SSLException {
+            delegate.closeInbound();
+        }
+
+        @Override
+        public boolean isInboundDone() {
+            return delegate.isInboundDone();
+        }
+
+        @Override
+        public void closeOutbound() {
+            delegate.closeOutbound();
+        }
+
+        @Override
+        public boolean isOutboundDone() {
+            return delegate.isOutboundDone();
+        }
+
+        @Override
+        public String[] getSupportedCipherSuites() {
+            return delegate.getSupportedCipherSuites();
+        }
+
+        @Override
+        public String[] getEnabledCipherSuites() {
+            return delegate.getEnabledCipherSuites();
+        }
+
+        @Override
+        public void setEnabledCipherSuites(String[] suites) {
+            delegate.setEnabledCipherSuites(suites);
+        }
+
+        @Override
+        public String[] getSupportedProtocols() {
+            return delegate.getSupportedProtocols();
+        }
+
+        @Override
+        public String[] getEnabledProtocols() {
+            return delegate.getEnabledProtocols();
+        }
+
+        @Override
+        public void setEnabledProtocols(String[] protocols) {
+            delegate.setEnabledProtocols(protocols);
+        }
+
+        @Override
+        public SSLSession getSession() {
+            return delegate.getSession();
+        }
+
+        @Override
+        public SSLSession getHandshakeSession() {
+            return delegate.getHandshakeSession();
+        }
+
+        @Override
+        public void beginHandshake() throws SSLException {
+            delegate.beginHandshake();
+        }
+
+        @Override
+        public SSLEngineResult.HandshakeStatus getHandshakeStatus() {
+            return delegate.getHandshakeStatus();
+        }
+
+        @Override
+        public void setUseClientMode(boolean mode) {
+            delegate.setUseClientMode(mode);
+        }
+
+        @Override
+        public boolean getUseClientMode() {
+            return delegate.getUseClientMode();
+        }
+
+        @Override
+        public void setNeedClientAuth(boolean need) {
+            delegate.setNeedClientAuth(need);
+        }
+
+        @Override
+        public boolean getNeedClientAuth() {
+            return delegate.getNeedClientAuth();
+        }
+
+        @Override
+        public void setWantClientAuth(boolean want) {
+            delegate.setWantClientAuth(want);
+        }
+
+        @Override
+        public boolean getWantClientAuth() {
+            return delegate.getWantClientAuth();
+        }
+
+        @Override
+        public void setEnableSessionCreation(boolean flag) {
+            delegate.setEnableSessionCreation(flag);
+        }
+
+        @Override
+        public boolean getEnableSessionCreation() {
+            return delegate.getEnableSessionCreation();
+        }
+
+        @Override
+        public SSLParameters getSSLParameters() {
+            return delegate.getSSLParameters();
+        }
+
+        @Override
+        public void setSSLParameters(SSLParameters params) {
+            delegate.setSSLParameters(params);
+        }
+
+        @Override
+        public String getApplicationProtocol() {
+            return delegate.getApplicationProtocol();
+        }
+
+        @Override
+        public String getHandshakeApplicationProtocol() {
+            return delegate.getHandshakeApplicationProtocol();
+        }
+
+        @Override
+        public void setHandshakeApplicationProtocolSelector(BiFunction<SSLEngine, List<String>, String> selector) {
+            if (selector == null) {
+                delegate.setHandshakeApplicationProtocolSelector(null);
+            } else {
+                delegate.setHandshakeApplicationProtocolSelector((engine, protocols) -> selector.apply(this, protocols));
+            }
+        }
+
+        @Override
+        public BiFunction<SSLEngine, List<String>, String> getHandshakeApplicationProtocolSelector() {
+            return delegate.getHandshakeApplicationProtocolSelector();
+        }
+    }
+
+    private static class HttpClientKey {
+        private final int connectTimeout;
+        private final String proxyHost;
+        private final int proxyPort;
+        private final String proxyUser;
+        private final String proxyPass;
+        private final boolean autoRedirects;
+        private final SSLContext sslContext;
+
+        HttpClientKey(int connectTimeout, String proxyHost, int proxyPort,
+                      String proxyUser, String proxyPass, boolean autoRedirects,
+                      SSLContext sslContext) {
+            this.connectTimeout = connectTimeout;
+            this.proxyHost = proxyHost;
+            this.proxyPort = proxyPort;
+            this.proxyUser = proxyUser;
+            this.proxyPass = proxyPass;
+            this.autoRedirects = autoRedirects;
+            this.sslContext = sslContext;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) {
+                return true;
+            }
+            if (!(o instanceof HttpClientKey that)) {
+                return false;
+            }
+            return connectTimeout == that.connectTimeout
+                    && proxyPort == that.proxyPort
+                    && autoRedirects == that.autoRedirects
+                    && Objects.equals(proxyHost, that.proxyHost)
+                    && Objects.equals(proxyUser, that.proxyUser)
+                    && Objects.equals(proxyPass, that.proxyPass)
+                    && Objects.equals(sslContext, that.sslContext);
+        }
+
+        @Override
+        public int hashCode() {
+            return Objects.hash(connectTimeout, proxyHost, proxyPort, proxyUser, proxyPass, autoRedirects, sslContext);
+        }
+    }
+
+    private static class CapturingHttpURLConnection extends HttpURLConnection {
+        private final Map<String, List<String>> requestProperties = new LinkedHashMap<>();
+        private final ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+
+        CapturingHttpURLConnection(URL url, String method) {
+            super(url);
+            this.method = method;
+        }
+
+        @Override
+        public void setRequestProperty(String key, String value) {
+            if (key == null) {
+                return;
+            }
+            List<String> list = new ArrayList<>();
+            list.add(value);
+            requestProperties.put(key, list);
+        }
+
+        @Override
+        public void addRequestProperty(String key, String value) {
+            if (key == null) {
+                return;
+            }
+            requestProperties.computeIfAbsent(key, k -> new ArrayList<>()).add(value);
+        }
+
+        @Override
+        public String getRequestProperty(String key) {
+            if (key == null) {
+                return null;
+            }
+            List<String> values = requestProperties.get(key);
+            if (values == null || values.isEmpty()) {
+                for (Map.Entry<String, List<String>> entry : requestProperties.entrySet()) {
+                    if (key.equalsIgnoreCase(entry.getKey())) {
+                        values = entry.getValue();
+                        break;
+                    }
+                }
+            }
+            return (values != null && !values.isEmpty()) ? values.get(0) : null;
+        }
+
+        @Override
+        public Map<String, List<String>> getRequestProperties() {
+            return Collections.unmodifiableMap(requestProperties);
+        }
+
+        @Override
+        public java.io.OutputStream getOutputStream() throws IOException {
+            return outputStream;
+        }
+
+        byte[] getCapturedBytes() {
+            return outputStream.toByteArray();
+        }
+
+        @Override
+        public void connect() throws IOException {
+        }
+
+        @Override
+        public void disconnect() {
+        }
+
+        @Override
+        public boolean usingProxy() {
+            return false;
+        }
+
+        @Override
+        public String getHeaderField(int n) {
+            return null;
+        }
+
+        @Override
+        public String getHeaderFieldKey(int n) {
+            return null;
+        }
+
+        @Override
+        public String getHeaderField(String name) {
+            return null;
+        }
+    }
 }
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPSamplerBase.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPSamplerBase.java
index 3105d0cf1ec..ee307623677 100644
--- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPSamplerBase.java
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPSamplerBase.java
@@ -160,6 +160,8 @@ public abstract class HTTPSamplerBase extends AbstractSampler
 
     public static final String IMPLEMENTATION = "HTTPSampler.implementation"; // $NON-NLS-1$
 
+    public static final String HTTP_VERSION = "HTTPSampler.httpVersion"; // $NON-NLS-1$
+
     public static final String PATH = "HTTPSampler.path"; // $NON-NLS-1$
 
     public static final String FOLLOW_REDIRECTS = HTTPSamplerBaseSchema.INSTANCE.getFollowRedirects().getName();
@@ -640,6 +642,14 @@ public String getImplementation() {
         return get(getSchema().getImplementation());
     }
 
+    public void setHttpVersion(String value) {
+        set(getSchema().getHttpVersion(), value);
+    }
+
+    public String getHttpVersion() {
+        return get(getSchema().getHttpVersion());
+    }
+
     public boolean useMD5() {
         return get(getSchema().getStoreAsMD5());
     }
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPSamplerFactory.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPSamplerFactory.java
index 1b9798bad4f..30f0d902dcc 100644
--- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPSamplerFactory.java
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/sampler/HTTPSamplerFactory.java
@@ -17,6 +17,7 @@
 
 package org.apache.jmeter.protocol.http.sampler;
 
+import org.apache.jmeter.protocol.http.util.HTTPConstants;
 import org.apache.jmeter.util.JMeterUtils;
 import org.apache.jorphan.util.StringUtilities;
 
@@ -38,6 +39,8 @@ public final class HTTPSamplerFactory {
     //+ JMX implementation attribute values (also displayed in GUI) - do not change
     public static final String IMPL_HTTP_CLIENT4 = "HttpClient4";  // $NON-NLS-1$
 
+    public static final String IMPL_HTTP_CLIENT5 = "HttpClient5";  // $NON-NLS-1$
+
     public static final String IMPL_HTTP_CLIENT3_1 = "HttpClient3.1"; // $NON-NLS-1$
 
     public static final String IMPL_JAVA = "Java"; // $NON-NLS-1$
@@ -62,7 +65,7 @@ public static HTTPSamplerBase newInstance() {
     /**
      * Create a new instance of the required sampler type
      *
-     * @param alias HTTP_SAMPLER or HTTP_SAMPLER_APACHE or IMPL_HTTP_CLIENT3_1 or IMPL_HTTP_CLIENT4
+     * @param alias HTTP_SAMPLER or HTTP_SAMPLER_APACHE or IMPL_HTTP_CLIENT3_1, IMPL_HTTP_CLIENT4 or IMPL_HTTP_CLIENT5
      * @return the appropriate sampler
      * @throws UnsupportedOperationException if alias is not recognised
      */
@@ -76,11 +79,38 @@ public static HTTPSamplerBase newInstance(String alias) {
         if (alias.equals(IMPL_HTTP_CLIENT4) || alias.equals(HTTP_SAMPLER_APACHE) || alias.equals(IMPL_HTTP_CLIENT3_1)) {
             return new HTTPSamplerProxy(IMPL_HTTP_CLIENT4);
         }
+        if (alias.equals(IMPL_HTTP_CLIENT5)) {
+            return new HTTPSamplerProxy(IMPL_HTTP_CLIENT5);
+        }
         throw new IllegalArgumentException("Unknown sampler type: '" + alias+"'");
     }
 
     public static String[] getImplementations(){
-        return new String[]{IMPL_HTTP_CLIENT4,IMPL_JAVA};
+        return new String[]{IMPL_HTTP_CLIENT4, IMPL_HTTP_CLIENT5, IMPL_JAVA};
+    }
+
+    /**
+     * Returns the HTTP versions the given implementation can actually use, starting with the empty
+     * value which leaves the choice to the {@code httpclient.version} property. Implementations
+     * which ignore the HTTP version of the sampler do not offer HTTP/2 at all, so a combination
+     * that would be silently dropped cannot be selected in the first place.
+     *
+     * @param implementation implementation name, an empty value refers to the default implementation
+     * @return the selectable values of the {@code HTTPSampler.httpVersion} property
+     */
+    public static String[] getHttpVersions(String implementation) {
+        String impl = StringUtilities.isBlank(implementation) ? DEFAULT_CLASSNAME : implementation;
+        if (IMPL_HTTP_CLIENT5.equals(impl)) {
+            // HttpClient 5 is the only implementation which can require HTTP/2 for the connection
+            return new String[]{"", HTTPConstants.HTTP_VERSION_1_1, HTTPConstants.HTTP_VERSION_2,
+                    HTTPConstants.HTTP_VERSION_2_STRICT};
+        }
+        if (IMPL_JAVA.equals(impl) || HTTP_SAMPLER_JAVA.equals(impl)) {
+            // java.net.http.HttpClient always negotiates, it has no API to insist on HTTP/2
+            return new String[]{"", HTTPConstants.HTTP_VERSION_1_1, HTTPConstants.HTTP_VERSION_2};
+        }
+        // HttpClient4 (and its aliases) never read the HTTP version of the sampler
+        return new String[]{"", HTTPConstants.HTTP_VERSION_1_1};
     }
 
     public static HTTPAbstractImpl getImplementation(String impl, HTTPSamplerBase base){
@@ -94,6 +124,8 @@ public static HTTPAbstractImpl getImplementation(String impl, HTTPSamplerBase ba
             return new HTTPJavaImpl(base);
         } else if (IMPL_HTTP_CLIENT4.equals(impl) || IMPL_HTTP_CLIENT3_1.equals(impl)) {
             return new HTTPHC4Impl(base);
+        } else if (IMPL_HTTP_CLIENT5.equals(impl)) {
+            return new HTTPHC5Impl(base);
         } else {
             throw new IllegalArgumentException("Unknown implementation type: '"+impl+"'");
         }
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/util/HTTPConstantsInterface.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/util/HTTPConstantsInterface.java
index fffb369de34..cf4d7adadd8 100644
--- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/util/HTTPConstantsInterface.java
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/util/HTTPConstantsInterface.java
@@ -33,6 +33,18 @@ public interface HTTPConstantsInterface { // CHECKSTYLE IGNORE InterfaceIsType
     String DEFAULT_HTTP_PORT_STRING = "80"; // $NON-NLS-1$
     String PROTOCOL_HTTP = "http"; // $NON-NLS-1$
     String PROTOCOL_HTTPS = "https"; // $NON-NLS-1$
+    /** Value of the sampler {@code HTTPSampler.httpVersion} property which forces HTTP/1.1. */
+    String HTTP_VERSION_1_1 = "HTTP/1.1"; // $NON-NLS-1$
+    /**
+     * Value of the sampler {@code HTTPSampler.httpVersion} property which uses HTTP/2 if the server
+     * agrees to it, falling back to HTTP/1.1 otherwise.
+     */
+    String HTTP_VERSION_2 = "HTTP/2"; // $NON-NLS-1$
+    /**
+     * Value of the sampler {@code HTTPSampler.httpVersion} property which requires HTTP/2, so a
+     * server that does not support it fails the sample instead of being used with HTTP/1.1.
+     */
+    String HTTP_VERSION_2_STRICT = "HTTP/2 Strict"; // $NON-NLS-1$
     String HEAD = "HEAD"; // $NON-NLS-1$
     String POST = "POST"; // $NON-NLS-1$
     String PUT = "PUT"; // $NON-NLS-1$
diff --git a/src/protocol/http/src/main/kotlin/org/apache/jmeter/protocol/http/sampler/HTTPSamplerBaseSchema.kt b/src/protocol/http/src/main/kotlin/org/apache/jmeter/protocol/http/sampler/HTTPSamplerBaseSchema.kt
index 89bb2f58e28..84698fff881 100644
--- a/src/protocol/http/src/main/kotlin/org/apache/jmeter/protocol/http/sampler/HTTPSamplerBaseSchema.kt
+++ b/src/protocol/http/src/main/kotlin/org/apache/jmeter/protocol/http/sampler/HTTPSamplerBaseSchema.kt
@@ -87,6 +87,9 @@ public abstract class HTTPSamplerBaseSchema : TestElementSchema() {
     public val implementation: StringPropertyDescriptor<HTTPSamplerBaseSchema>
         by string("HTTPSampler.implementation")
 
+    public val httpVersion: StringPropertyDescriptor<HTTPSamplerBaseSchema>
+        by string("HTTPSampler.httpVersion")
+
     public val connectTimeout: IntegerPropertyDescriptor<HTTPSamplerBaseSchema>
         by int("HTTPSampler.connect_timeout")
 
diff --git a/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/gui/TestHttpVersionComboBox.java b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/gui/TestHttpVersionComboBox.java
new file mode 100644
index 00000000000..88027121c52
--- /dev/null
+++ b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/gui/TestHttpVersionComboBox.java
@@ -0,0 +1,113 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jmeter.protocol.http.gui;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.swing.JComboBox;
+
+import org.apache.jmeter.protocol.http.sampler.HTTPSamplerFactory;
+import org.junit.jupiter.api.Test;
+
+public class TestHttpVersionComboBox {
+
+    private static JComboBox<String> implementationComboBox() {
+        JComboBox<String> implementation = new JComboBox<>(HTTPSamplerFactory.getImplementations());
+        implementation.addItem("");
+        return implementation;
+    }
+
+    private static List<String> items(JComboBox<String> comboBox) {
+        List<String> items = new ArrayList<>();
+        for (int i = 0; i < comboBox.getItemCount(); i++) {
+            items.add(comboBox.getItemAt(i));
+        }
+        return items;
+    }
+
+    @Test
+    void offersTheVersionsOfTheSelectedImplementation() {
+        JComboBox<String> implementation = implementationComboBox();
+        HttpVersionComboBox httpVersion = new HttpVersionComboBox();
+        httpVersion.bindToImplementation(implementation);
+
+        implementation.setSelectedItem("HttpClient5");
+        assertEquals(Arrays.asList("", "HTTP/1.1", "HTTP/2", "HTTP/2 Strict"), items(httpVersion));
+
+        implementation.setSelectedItem("Java");
+        assertEquals(Arrays.asList("", "HTTP/1.1", "HTTP/2"), items(httpVersion));
+
+        implementation.setSelectedItem("HttpClient4");
+        assertEquals(Arrays.asList("", "HTTP/1.1"), items(httpVersion));
+    }
+
+    @Test
+    void keepsTheSelectionWhenTheNewImplementationSupportsIt() {
+        JComboBox<String> implementation = implementationComboBox();
+        HttpVersionComboBox httpVersion = new HttpVersionComboBox();
+        httpVersion.bindToImplementation(implementation);
+
+        implementation.setSelectedItem("HttpClient5");
+        httpVersion.setSelectedItem("HTTP/2");
+        implementation.setSelectedItem("Java");
+
+        assertEquals("HTTP/2", httpVersion.getSelectedItem());
+    }
+
+    @Test
+    void resetsTheSelectionWhenTheNewImplementationDoesNotSupportIt() {
+        JComboBox<String> implementation = implementationComboBox();
+        HttpVersionComboBox httpVersion = new HttpVersionComboBox();
+        httpVersion.bindToImplementation(implementation);
+
+        implementation.setSelectedItem("HttpClient5");
+        httpVersion.setSelectedItem("HTTP/2 Strict");
+        implementation.setSelectedItem("Java");
+
+        assertEquals("", httpVersion.getSelectedItem());
+    }
+
+    @Test
+    void keepsAValueWhichIsNotOffered() {
+        JComboBox<String> implementation = implementationComboBox();
+        HttpVersionComboBox httpVersion = new HttpVersionComboBox();
+        httpVersion.bindToImplementation(implementation);
+
+        implementation.setSelectedItem("HttpClient4");
+        httpVersion.setSelectedItem("HTTP/2");
+
+        assertEquals("HTTP/2", httpVersion.getSelectedItem());
+    }
+
+    @Test
+    void dropsAValueWhichIsNotOfferedWhenTheImplementationIsSetAgain() {
+        HttpVersionComboBox httpVersion = new HttpVersionComboBox();
+
+        httpVersion.setImplementation("HttpClient4");
+        httpVersion.setSelectedItem("HTTP/2");
+        assertEquals(Arrays.asList("", "HTTP/1.1", "HTTP/2"), items(httpVersion));
+
+        httpVersion.setImplementation("HttpClient4");
+        assertEquals(Arrays.asList("", "HTTP/1.1"), items(httpVersion));
+        assertEquals("", httpVersion.getSelectedItem());
+    }
+}
diff --git a/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestDecompression.java b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestDecompression.java
index 82d22bda273..e733f497778 100644
--- a/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestDecompression.java
+++ b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestDecompression.java
@@ -112,6 +112,76 @@ public void mockServer(String httpImpl, ClientGzip clientGzip, ServerGzip server
         }
     }
 
+    public static List<Arguments> http2Params() {
+        List<Arguments> res = new ArrayList<>();
+        for (ClientGzip clientGzip : ClientGzip.values()) {
+            for (ServerGzip serverGzip : ServerGzip.values()) {
+                res.add(Arguments.of(clientGzip, serverGzip));
+            }
+        }
+        return res;
+    }
+
+    /**
+     * HttpClient5 uses the async transport for HTTP/2, which decompresses responses in a different
+     * code path than the HTTP/1.1 transport, so both have to report the same headers and body.
+     */
+    @ParameterizedTest
+    @MethodSource("http2Params")
+    public void http2(ClientGzip clientGzip, ServerGzip serverGzip) throws MalformedURLException {
+        WireMockServer server = new WireMockServer(WireMockConfiguration.wireMockConfig()
+                .dynamicHttpsPort()
+                .http2TlsDisabled(false)
+                .gzipDisabled(serverGzip == ServerGzip.NOT_SUPPORTED));
+        server.start();
+        try {
+            HTTPSamplerBase http = HTTPSamplerFactory.newInstance(HTTPSamplerFactory.IMPL_HTTP_CLIENT5);
+            http.setHttpVersion("HTTP/2");
+            String expectedResponse = "Hello, 丈, \uD83D\uDE03, and नि";
+            HeaderManager hm = new HeaderManager();
+            if (clientGzip == ClientGzip.REQUESTED) {
+                hm.add(new Header("Accept-Encoding", "gzip"));
+            }
+            hm.add(new Header("Content-Encoding", "utf-8"));
+            http.setHeaderManager(hm);
+            MappingBuilder mappingBuilder = WireMock.get("/gzip");
+            if (clientGzip == ClientGzip.REQUESTED) {
+                mappingBuilder = mappingBuilder.withHeader("Accept-Encoding", WireMock.equalTo("gzip"));
+            }
+            server.stubFor(
+                    mappingBuilder
+                            .willReturn(
+                                    WireMock.aResponse()
+                                            .withBody(expectedResponse)
+                                            .withHeader("Content-Type", "text/plain;charset=utf-8")
+                            )
+            );
+
+            HTTPSampleResult res = http.sample(
+                    new URL("https://localhost:" + server.httpsPort() + "/gzip"), "GET", false, 1);
+
+            Assertions.assertAll(
+                    () -> assertEquals(expectedResponse, res.getResponseDataAsString(), "response body"),
+                    () -> {
+                        // HTTP/2 header names are lower case, so compare them ignoring case
+                        if (clientGzip == ClientGzip.NOT_REQUESTED || serverGzip == ServerGzip.NOT_SUPPORTED) {
+                            assertFalse(
+                                    StringsKt.contains(res.getResponseHeaders(), "Content-Encoding:", true),
+                                    () -> "clientGzip is " + clientGzip + ", so Content-Encoding header should NOT be present"
+                            );
+                        } else {
+                            assertTrue(
+                                    StringsKt.contains(res.getResponseHeaders(), "Content-Encoding: gzip", true),
+                                    () -> "clientGzip is " + clientGzip + ", so Content-Encoding: gzip header should be present"
+                            );
+                        }
+                    }
+            );
+        } finally {
+            server.stop();
+        }
+    }
+
     private static WireMockServer createServer(Consumer<WireMockConfiguration> config) {
         WireMockConfiguration configuration =
                 WireMockConfiguration
diff --git a/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPHC5Features.java b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPHC5Features.java
new file mode 100644
index 00000000000..e9601551938
--- /dev/null
+++ b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPHC5Features.java
@@ -0,0 +1,851 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jmeter.protocol.http.sampler;
+
+import static com.github.tomakehurst.wiremock.client.WireMock.aResponse;
+import static com.github.tomakehurst.wiremock.client.WireMock.get;
+import static com.github.tomakehurst.wiremock.client.WireMock.getRequestedFor;
+import static com.github.tomakehurst.wiremock.client.WireMock.post;
+import static com.github.tomakehurst.wiremock.client.WireMock.urlEqualTo;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.ByteArrayInputStream;
+import java.io.Closeable;
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import org.apache.hc.client5.http.HttpRoute;
+import org.apache.hc.client5.http.auth.AuthSchemeFactory;
+import org.apache.hc.client5.http.auth.AuthScope;
+import org.apache.hc.client5.http.auth.StandardAuthScheme;
+import org.apache.hc.client5.http.classic.methods.HttpUriRequestBase;
+import org.apache.hc.client5.http.io.ConnectionEndpoint;
+import org.apache.hc.client5.http.io.HttpClientConnectionManager;
+import org.apache.hc.client5.http.io.LeaseRequest;
+import org.apache.hc.client5.http.protocol.HttpClientContext;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.config.Lookup;
+import org.apache.hc.core5.http.protocol.HttpContext;
+import org.apache.hc.core5.http2.HttpVersionPolicy;
+import org.apache.hc.core5.http2.config.H2Config;
+import org.apache.hc.core5.io.CloseMode;
+import org.apache.hc.core5.util.TimeValue;
+import org.apache.hc.core5.util.Timeout;
+import org.apache.jmeter.protocol.http.control.AuthManager;
+import org.apache.jmeter.protocol.http.control.CacheManager;
+import org.apache.jmeter.protocol.http.util.HTTPConstants;
+import org.apache.jmeter.samplers.SampleResult;
+import org.apache.jmeter.util.JMeterUtils;
+import org.apache.jorphan.util.JOrphanUtils;
+import org.junit.jupiter.api.Test;
+
+import com.github.tomakehurst.wiremock.WireMockServer;
+import com.github.tomakehurst.wiremock.client.WireMock;
+import com.github.tomakehurst.wiremock.core.WireMockConfiguration;
+
+class TestHTTPHC5Features {
+
+    @Test
+    void usesHttpClientVersionWhenSamplerVersionIsEmpty() {
+        assertEquals(HttpVersionPolicy.NEGOTIATE, HTTPHC5Impl.getHttpVersionPolicy("", "HTTP/2"));
+    }
+
+    @Test
+    void usesSamplerHttpVersionWhenSpecified() {
+        assertEquals(HttpVersionPolicy.FORCE_HTTP_1, HTTPHC5Impl.getHttpVersionPolicy("HTTP/1.1", "HTTP/2"));
+        assertEquals(HttpVersionPolicy.NEGOTIATE, HTTPHC5Impl.getHttpVersionPolicy("HTTP/2", "HTTP/1.1"));
+    }
+
+    @Test
+    void defaultsToHttp11ForUnsupportedHttpVersion() {
+        assertEquals(HttpVersionPolicy.FORCE_HTTP_1, HTTPHC5Impl.getHttpVersionPolicy("HTTP/3", "HTTP/2"));
+    }
+
+    @Test
+    void negotiatesHttp2OverTls() {
+        assertEquals(HttpVersionPolicy.NEGOTIATE, HTTPHC5Impl.getHttpVersionPolicy("HTTP/2", "HTTP/1.1", "https"));
+    }
+
+    @Test
+    void doesNotUsePriorKnowledgeForCleartextByDefault() {
+        assertEquals(HttpVersionPolicy.NEGOTIATE, HTTPHC5Impl.getHttpVersionPolicy("HTTP/2", "HTTP/1.1", "http"));
+    }
+
+    @Test
+    void requiresHttp2ForStrictHttp2RegardlessOfScheme() {
+        assertEquals(HttpVersionPolicy.FORCE_HTTP_2,
+                HTTPHC5Impl.getHttpVersionPolicy("HTTP/2 Strict", "HTTP/1.1"));
+        assertEquals(HttpVersionPolicy.FORCE_HTTP_2,
+                HTTPHC5Impl.getHttpVersionPolicy("HTTP/2 Strict", "HTTP/1.1", "https"));
+        assertEquals(HttpVersionPolicy.FORCE_HTTP_2,
+                HTTPHC5Impl.getHttpVersionPolicy("HTTP/2 Strict", "HTTP/1.1", "http"));
+        assertEquals(HttpVersionPolicy.FORCE_HTTP_2,
+                HTTPHC5Impl.getHttpVersionPolicy("", "HTTP/2 Strict", "https"));
+    }
+
+    @Test
+    void multiplexesConcurrentRequestsOverASingleHttp2Connection() throws Exception {
+        WireMockServer server = new WireMockServer(WireMockConfiguration.wireMockConfig()
+                .dynamicHttpsPort()
+                .http2TlsDisabled(false));
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/multiplexed"))
+                    .willReturn(aResponse().withStatus(200).withFixedDelay(200)));
+            URL url = new URL("https://localhost:" + server.httpsPort() + "/multiplexed");
+            // warm up, so the connection that gets shared by the concurrent samples is already established
+            HTTPSamplerBase warmUpSampler = newSampler();
+            warmUpSampler.setHttpVersion("HTTP/2");
+            assertEquals("200", warmUpSampler.sample(url, HTTPConstants.GET, false, 1).getResponseCode());
+
+            int requests = 4;
+            ExecutorService executor = Executors.newFixedThreadPool(requests);
+            try {
+                List<Future<HTTPSampleResult>> results = new ArrayList<>();
+                for (int i = 0; i < requests; i++) {
+                    results.add(executor.submit(() -> {
+                        HTTPSamplerBase sampler = newSampler();
+                        sampler.setHttpVersion("HTTP/2");
+                        return sampler.sample(url, HTTPConstants.GET, false, 1);
+                    }));
+                }
+                for (Future<HTTPSampleResult> result : results) {
+                    HTTPSampleResult sampleResult = result.get(30, TimeUnit.SECONDS);
+                    assertEquals("200", sampleResult.getResponseCode());
+                    assertEquals("HTTP/2", sampleResult.getResponseHeaders().substring(0, "HTTP/2".length()));
+                }
+            } finally {
+                executor.shutdownNow();
+            }
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void enablesMessageMultiplexingWithoutRequiringHttpClient55() throws Exception {
+        byte[] classBytes;
+        try (InputStream classFile = HTTPHC5Impl.class.getResourceAsStream("HTTPHC5Impl.class")) {
+            classBytes = classFile.readAllBytes();
+        }
+        assertTrue(new String(classBytes, StandardCharsets.ISO_8859_1).contains("setMessageMultiplexing"),
+                "HTTP/2 message multiplexing should be enabled");
+        assertFalse(hasMethodReference(classBytes,
+                "org/apache/hc/client5/http/impl/nio/PoolingAsyncClientConnectionManagerBuilder",
+                "setMessageMultiplexing"),
+                "setMessageMultiplexing was added in HttpClient 5.5 and must not be linked directly");
+    }
+
+    @Test
+    void appliesHttp2ProtocolSettings() {
+        H2Config config = HTTPHC5Impl.createHttp2Config();
+
+        assertEquals(8192, config.getHeaderTableSize(), "HPACK dynamic table size");
+        assertTrue(config.isCompressionEnabled(), "HPACK header compression");
+        assertEquals(250, config.getMaxConcurrentStreams());
+        assertEquals(65535, config.getInitialWindowSize());
+        assertEquals(65536, config.getMaxFrameSize());
+        assertFalse(config.isPushEnabled(), "server push is dropped by JMeter, so it must not be announced");
+    }
+
+    @Test
+    void doesNotRequireProtocolUpgradeConfiguration() throws Exception {
+        try (InputStream classFile = HTTPHC5Impl.class.getResourceAsStream("HTTPHC5Impl.class")) {
+            assertFalse(new String(classFile.readAllBytes(), StandardCharsets.ISO_8859_1)
+                    .contains("setProtocolUpgradeEnabled"));
+        }
+    }
+
+    @Test
+    void doesNotRequireHttpAsyncClassicAdapter() throws Exception {
+        try (InputStream classFile = HTTPHC5Impl.class.getResourceAsStream("HTTPHC5Impl.class")) {
+            assertFalse(hasMethodReference(classFile.readAllBytes(),
+                    "org/apache/hc/client5/http/impl/async/HttpAsyncClients", "classic"));
+        }
+    }
+
+    @Test
+    void usesHttp2WhenSelected() throws Exception {
+        WireMockServer server = new WireMockServer(WireMockConfiguration.wireMockConfig()
+                .dynamicHttpsPort()
+                .http2TlsDisabled(false));
+        try {
+            server.start();
+            server.stubFor(get(urlEqualTo("/http2")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL("https://localhost:" + server.httpsPort() + "/http2"), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertEquals("HTTP/2", result.getResponseHeaders().substring(0, "HTTP/2".length()));
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void fallsBackToHttp11WhenServerDoesNotSupportHttp2() throws Exception {
+        WireMockServer server = new WireMockServer(WireMockConfiguration.wireMockConfig()
+                .dynamicHttpsPort()
+                .http2TlsDisabled(true));
+        try {
+            server.start();
+            server.stubFor(get(urlEqualTo("/fallback")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL("https://localhost:" + server.httpsPort() + "/fallback"), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertEquals("HTTP/1.1", result.getResponseHeaders().substring(0, "HTTP/1.1".length()));
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void usesHttp2WithProxy() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/http2proxy")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+            sampler.setProxyHost("localhost");
+            sampler.setProxyPortInt(Integer.toString(server.port()));
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/http2proxy")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void usesHttp11WhenSelected() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/http11")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/1.1");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/http11")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertEquals("HTTP/1.1", result.getResponseHeaders().substring(0, "HTTP/1.1".length()));
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsSentBytesCorrectlyForGetRequest() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/sentBytesGet")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/1.1");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/sentBytesGet")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getSentBytes() > 0, "sentBytes should be greater than 0");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsSentBytesCorrectlyForPostRequest() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(post(urlEqualTo("/sentBytesPost")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/1.1");
+            sampler.setPostBodyRaw(true);
+            sampler.addNonEncodedArgument("", "hello world", "");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/sentBytesPost")), HTTPConstants.POST, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getSentBytes() > "hello world".length(), "sentBytes should include request line, headers, and body");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void sendsConditionalRequestForCachedResource() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/cache"))
+                    .willReturn(aResponse().withHeader("ETag", "cache-tag").withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setCacheManager(new CacheManager());
+            URL url = new URL(server.url("/cache"));
+
+            assertEquals("200", sampler.sample(url, HTTPConstants.GET, false, 1).getResponseCode());
+            assertEquals("200", sampler.sample(url, HTTPConstants.GET, false, 1).getResponseCode());
+
+            server.verify(1, getRequestedFor(urlEqualTo("/cache"))
+                    .withHeader("If-None-Match", WireMock.equalTo("cache-tag")));
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void sendsBasicCredentialsFromAuthorizationManager() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/auth"))
+                    .withHeader("Authorization", WireMock.equalTo("Basic dXNlcjpwYXNz"))
+                    .willReturn(aResponse().withStatus(200)));
+            server.stubFor(get(urlEqualTo("/auth")).atPriority(10)
+                    .willReturn(aResponse().withHeader("WWW-Authenticate", "Basic realm=\"test\"").withStatus(401)));
+            AuthManager authManager = new AuthManager();
+            authManager.set(-1, server.url("/"), "user", "pass", "", "", AuthManager.Mechanism.BASIC);
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setAuthManager(authManager);
+
+            assertEquals("200", sampler.sample(new URL(server.url("/auth")), HTTPConstants.GET, false, 1).getResponseCode());
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    @SuppressWarnings("deprecation") // The GSS based auth schemes of HttpClient 5 have no replacement yet
+    void sendsNegotiateCredentialsForKerberosAuthorization() throws Exception {
+        AuthManager authManager = new AuthManager();
+        authManager.set(-1, "http://kerberos.example.invalid/", "user", "pass", "", "", AuthManager.Mechanism.KERBEROS);
+        HTTPSamplerBase sampler = newSampler();
+        sampler.setAuthManager(authManager);
+        HTTPHC5Impl implementation = new HTTPHC5Impl(sampler);
+        URL url = new URL("http://kerberos.example.invalid/protected");
+        HttpUriRequestBase request = new HttpUriRequestBase(HTTPConstants.GET, url.toURI());
+
+        HttpClientContext context =
+                implementation.createHttpClientContext(url, implementation.createHttpClientKey(url), request);
+
+        Lookup<AuthSchemeFactory> authSchemes = context.getAuthSchemeRegistry();
+        assertNotNull(authSchemes, "the Kerberos auth schemes have to be registered for the request");
+        assertNotNull(authSchemes.lookup(StandardAuthScheme.SPNEGO), "Negotiate has to be supported");
+        assertNotNull(authSchemes.lookup(StandardAuthScheme.KERBEROS), "Kerberos has to be supported");
+        assertEquals(List.of(StandardAuthScheme.SPNEGO, StandardAuthScheme.KERBEROS),
+                new ArrayList<>(request.getConfig().getTargetPreferredAuthSchemes()),
+                "HttpClient 5 only prefers Bearer, Digest and Basic by default");
+        assertNotNull(context.getCredentialsProvider().getCredentials(
+                        new AuthScope(null, "kerberos.example.invalid", 80, null, StandardAuthScheme.SPNEGO), context),
+                "the Negotiate scheme needs credentials to authenticate with");
+        assertFalse(request.containsHeader(HttpHeaders.AUTHORIZATION),
+                "the credentials of a Kerberos authorization are only used to log in to the KDC");
+    }
+
+    @Test
+    void keepsDefaultAuthSchemesWithoutKerberosAuthorization() throws Exception {
+        AuthManager authManager = new AuthManager();
+        authManager.set(-1, "http://basic.example.invalid/", "user", "pass", "", "", AuthManager.Mechanism.BASIC);
+        HTTPSamplerBase sampler = newSampler();
+        sampler.setAuthManager(authManager);
+        HTTPHC5Impl implementation = new HTTPHC5Impl(sampler);
+        URL url = new URL("http://basic.example.invalid/protected");
+        HttpUriRequestBase request = new HttpUriRequestBase(HTTPConstants.GET, url.toURI());
+
+        HttpClientContext context =
+                implementation.createHttpClientContext(url, implementation.createHttpClientKey(url), request);
+
+        assertNull(context.getAuthSchemeRegistry(), "the client should use its default auth schemes");
+        assertNull(request.getConfig(), "the request configuration should be left alone");
+    }
+
+    @Test
+    @SuppressWarnings("deprecation") // The GSS based auth schemes of HttpClient 5 have no replacement yet
+    void negotiatesWithAProxyThatHasNoCredentialsConfigured() throws Exception {
+        HTTPSamplerBase sampler = newSampler();
+        sampler.setProxyHost("proxy.example.invalid");
+        sampler.setProxyPortInt("8080");
+        HTTPHC5Impl implementation = new HTTPHC5Impl(sampler);
+        URL url = new URL("http://target.example.invalid/resource");
+        HttpUriRequestBase request = new HttpUriRequestBase(HTTPConstants.GET, url.toURI());
+
+        HttpClientContext context =
+                implementation.createHttpClientContext(url, implementation.createHttpClientKey(url), request);
+
+        Lookup<AuthSchemeFactory> authSchemes = context.getAuthSchemeRegistry();
+        assertNotNull(authSchemes, "the Kerberos auth schemes have to be registered for the request");
+        assertNotNull(authSchemes.lookup(StandardAuthScheme.SPNEGO), "Negotiate has to be supported");
+        assertEquals(List.of(StandardAuthScheme.SPNEGO, StandardAuthScheme.KERBEROS, StandardAuthScheme.BEARER,
+                        StandardAuthScheme.DIGEST, StandardAuthScheme.BASIC),
+                new ArrayList<>(request.getConfig().getProxyPreferredAuthSchemes()),
+                "a proxy challenging with Negotiate has to be answered with a Kerberos token");
+        assertNull(request.getConfig().getTargetPreferredAuthSchemes(),
+                "the target is not covered by a Kerberos authorization");
+        assertNotNull(context.getCredentialsProvider().getCredentials(
+                        new AuthScope(null, "proxy.example.invalid", 8080, null, StandardAuthScheme.SPNEGO), context),
+                "the Negotiate scheme needs credentials to authenticate with");
+    }
+
+    @Test
+    @SuppressWarnings("deprecation") // The GSS based auth schemes of HttpClient 5 have no replacement yet
+    void negotiatesWithAProxyCoveredByAKerberosAuthorization() throws Exception {
+        AuthManager authManager = new AuthManager();
+        authManager.set(-1, "http://proxy.example.invalid:8080", "user", "pass", "", "",
+                AuthManager.Mechanism.KERBEROS);
+        HTTPSamplerBase sampler = newSampler();
+        sampler.setAuthManager(authManager);
+        sampler.setProxyHost("proxy.example.invalid");
+        sampler.setProxyPortInt("8080");
+        sampler.setProxyUser("user");
+        sampler.setProxyPass("pass");
+        HTTPHC5Impl implementation = new HTTPHC5Impl(sampler);
+        URL url = new URL("http://target.example.invalid/resource");
+        HttpUriRequestBase request = new HttpUriRequestBase(HTTPConstants.GET, url.toURI());
+
+        HttpClientContext context =
+                implementation.createHttpClientContext(url, implementation.createHttpClientKey(url), request);
+
+        assertNotNull(context.getAuthSchemeRegistry(), "the Kerberos auth schemes have to be registered");
+        assertEquals(StandardAuthScheme.SPNEGO,
+                new ArrayList<>(request.getConfig().getProxyPreferredAuthSchemes()).get(0),
+                "a Kerberos authorization for the proxy has to be preferred over the password based schemes");
+    }
+
+    @Test
+    void keepsDefaultAuthSchemesForAProxyWithCredentials() throws Exception {
+        HTTPSamplerBase sampler = newSampler();
+        sampler.setProxyHost("proxy.example.invalid");
+        sampler.setProxyPortInt("8080");
+        sampler.setProxyUser("user");
+        sampler.setProxyPass("pass");
+        HTTPHC5Impl implementation = new HTTPHC5Impl(sampler);
+        URL url = new URL("http://target.example.invalid/resource");
+        HttpUriRequestBase request = new HttpUriRequestBase(HTTPConstants.GET, url.toURI());
+
+        HttpClientContext context =
+                implementation.createHttpClientContext(url, implementation.createHttpClientKey(url), request);
+
+        assertNull(context.getAuthSchemeRegistry(), "the client should use its default auth schemes");
+        assertNull(request.getConfig(), "the request configuration should be left alone");
+    }
+
+    @Test
+    void authenticatesWithConfiguredProxyCredentials() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/proxy"))
+                    .withHeader("Proxy-Authorization", WireMock.equalTo("Basic dXNlcjpwYXNz"))
+                    .willReturn(aResponse().withStatus(200)));
+            server.stubFor(get(urlEqualTo("/proxy")).atPriority(10)
+                    .willReturn(aResponse().withHeader("Proxy-Authenticate", "Basic realm=\"proxy\"").withStatus(407)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setProxyHost("localhost");
+            sampler.setProxyPortInt(Integer.toString(server.port()));
+            sampler.setProxyUser("user");
+            sampler.setProxyPass("pass");
+
+            assertEquals("200", sampler.sample(new URL(server.url("/proxy")), HTTPConstants.GET, false, 1).getResponseCode());
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsConnectTimeForHttp11() throws Exception {
+        SampleResult result = new SampleResult();
+        result.sampleStart();
+        HttpClientContext context = HttpClientContext.create();
+        context.setAttribute(HTTPHC5Impl.CONTEXT_ATTRIBUTE_SAMPLER_RESULT, result);
+        HttpClientConnectionManager connectionManager =
+                new HTTPHC5Impl.ConnectTimeMeasuringConnectionManager(new SlowConnectingConnectionManager(50));
+
+        connectionManager.connect(null, null, context);
+        Thread.sleep(50);
+        result.sampleEnd();
+
+        assertTrue(result.getConnectTime() >= 50,
+                "connectTime should cover the time spent connecting, but was " + result.getConnectTime());
+        assertTrue(result.getConnectTime() <= result.getTime(),
+                "connectTime should not exceed the elapsed time");
+    }
+
+    /** Connection manager that only supports {@code connect} and takes a well-known amount of time for it. */
+    private static final class SlowConnectingConnectionManager implements HttpClientConnectionManager {
+
+        private final long connectDurationMillis;
+
+        SlowConnectingConnectionManager(long connectDurationMillis) {
+            this.connectDurationMillis = connectDurationMillis;
+        }
+
+        @Override
+        public LeaseRequest lease(String id, HttpRoute route, Timeout requestTimeout, Object state) {
+            throw new UnsupportedOperationException();
+        }
+
+        @Override
+        public void release(ConnectionEndpoint endpoint, Object newState, TimeValue validDuration) {
+            throw new UnsupportedOperationException();
+        }
+
+        @Override
+        public void connect(ConnectionEndpoint endpoint, TimeValue connectTimeout, HttpContext context) throws IOException {
+            try {
+                Thread.sleep(connectDurationMillis);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                throw new IOException(e);
+            }
+        }
+
+        @Override
+        public void upgrade(ConnectionEndpoint endpoint, HttpContext context) {
+            throw new UnsupportedOperationException();
+        }
+
+        @Override
+        public void close(CloseMode closeMode) {
+            // nothing to close
+        }
+
+        @Override
+        public void close() {
+            // nothing to close
+        }
+    }
+
+    @Test
+    void setsConnectTimeForHttp2() throws Exception {
+        WireMockServer server = new WireMockServer(WireMockConfiguration.wireMockConfig()
+                .dynamicHttpsPort()
+                .http2TlsDisabled(false));
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/connectTime2")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL("https://localhost:" + server.httpsPort() + "/connectTime2"), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getConnectTime() > 0,
+                    "connectTime should be greater than 0, but was " + result.getConnectTime());
+            assertTrue(result.getConnectTime() <= result.getTime(),
+                    "connectTime should not exceed the elapsed time");
+        } finally {
+            server.stop();
+        }
+    }
+
+    /**
+     * A pooled HTTP/2 connection that the server dropped while the thread was idle must not be handed
+     * out as it is. What triggers this is the idle gap between two samples, not the number of requests,
+     * so the test waits out {@code httpclient5.validate_after_inactivity} between the two samples and
+     * only then lets the connection die, while the client still believes it is usable.
+     *
+     * <p>Without the re-validation the second request is written to that connection and the sample
+     * fails with {@code ConnectionClosedException}, which is what
+     * {@link #doesNotRevalidatePooledHttp2ConnectionWithoutAnIdleGap()} pins down.
+     */
+    @Test
+    void revalidatesPooledHttp2ConnectionAfterIdleGap() throws Exception {
+        WireMockServer server = new WireMockServer(WireMockConfiguration.wireMockConfig()
+                .dynamicHttpsPort()
+                .http2TlsDisabled(false));
+        server.start();
+        try (ConnectionDroppingRelay relay = new ConnectionDroppingRelay(server.httpsPort())) {
+            server.stubFor(get(urlEqualTo("/idle")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+            sampler.setResponseTimeout("30000");
+            URL url = new URL("https://localhost:" + relay.getPort() + "/idle");
+
+            assertEquals("200", sampler.sample(url, HTTPConstants.GET, false, 1).getResponseCode());
+
+            Thread.sleep(validateAfterInactivityMillis() + 500);
+            relay.dropConnectionOnNextRequest();
+
+            // the same sampler on the same thread, so the cached HTTP/2 client and its pool are reused
+            HTTPSampleResult result = sampler.sample(url, HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode(),
+                    "the stale pooled connection should have been replaced, but the sample failed with "
+                            + result.getResponseMessage());
+            assertEquals(2, relay.getAcceptedConnections(),
+                    "the stale connection should have been discarded and replaced by a new one");
+        } finally {
+            server.stop();
+        }
+    }
+
+    /**
+     * Counterpart of {@link #revalidatesPooledHttp2ConnectionAfterIdleGap()} which documents the
+     * behaviour the re-validation fixes: without an idle gap the connection is leased without being
+     * checked, so the request itself runs into the connection the server has already given up on.
+     */
+    @Test
+    void doesNotRevalidatePooledHttp2ConnectionWithoutAnIdleGap() throws Exception {
+        WireMockServer server = new WireMockServer(WireMockConfiguration.wireMockConfig()
+                .dynamicHttpsPort()
+                .http2TlsDisabled(false));
+        server.start();
+        try (ConnectionDroppingRelay relay = new ConnectionDroppingRelay(server.httpsPort())) {
+            server.stubFor(get(urlEqualTo("/busy")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+            sampler.setResponseTimeout("30000");
+            URL url = new URL("https://localhost:" + relay.getPort() + "/busy");
+
+            assertEquals("200", sampler.sample(url, HTTPConstants.GET, false, 1).getResponseCode());
+            relay.dropConnectionOnNextRequest();
+
+            HTTPSampleResult result = sampler.sample(url, HTTPConstants.GET, false, 1);
+
+            assertFalse(result.isSuccessful(),
+                    "a connection reused within the validation interval is not checked, so the request "
+                            + "is expected to run into the dropped connection");
+        } finally {
+            server.stop();
+        }
+    }
+
+    private static long validateAfterInactivityMillis() {
+        return JMeterUtils.getPropDefault("httpclient5.validate_after_inactivity", 2000L);
+    }
+
+    /**
+     * Relays TCP traffic to a backend server and can drop a single relayed connection as soon as the
+     * client writes to it again, which is how an idle connection closed by the server (or by a load
+     * balancer) looks to a client that has not noticed the close yet. New connections are relayed as
+     * usual, so the backend stays reachable.
+     */
+    private static final class ConnectionDroppingRelay implements Closeable {
+
+        private final ServerSocket serverSocket;
+        private final int backendPort;
+        private final ExecutorService executor = Executors.newCachedThreadPool(runnable -> {
+            Thread thread = new Thread(runnable, "relay");
+            thread.setDaemon(true);
+            return thread;
+        });
+        private final AtomicInteger acceptedConnections = new AtomicInteger();
+        private volatile RelayedConnection currentConnection;
+
+        ConnectionDroppingRelay(int backendPort) throws IOException {
+            this.backendPort = backendPort;
+            this.serverSocket = new ServerSocket(0, 0, InetAddress.getLoopbackAddress());
+            executor.execute(this::acceptConnections);
+        }
+
+        int getPort() {
+            return serverSocket.getLocalPort();
+        }
+
+        int getAcceptedConnections() {
+            return acceptedConnections.get();
+        }
+
+        void dropConnectionOnNextRequest() {
+            RelayedConnection connection = currentConnection;
+            if (connection == null) {
+                throw new IllegalStateException("No connection has been relayed yet");
+            }
+            connection.doomed = true;
+        }
+
+        private void acceptConnections() {
+            while (!serverSocket.isClosed()) {
+                RelayedConnection connection;
+                try {
+                    Socket client = serverSocket.accept();
+                    connection = new RelayedConnection(client,
+                            new Socket(InetAddress.getLoopbackAddress(), backendPort));
+                } catch (IOException e) {
+                    return;
+                }
+                acceptedConnections.incrementAndGet();
+                currentConnection = connection;
+                executor.execute(connection::relayRequests);
+                executor.execute(connection::relayResponses);
+            }
+        }
+
+        @Override
+        public void close() throws IOException {
+            serverSocket.close();
+            executor.shutdownNow();
+        }
+    }
+
+    private static final class RelayedConnection {
+
+        private final Socket client;
+        private final Socket backend;
+        private volatile boolean doomed;
+
+        RelayedConnection(Socket client, Socket backend) {
+            this.client = client;
+            this.backend = backend;
+        }
+
+        void relayRequests() {
+            try {
+                InputStream input = client.getInputStream();
+                OutputStream output = backend.getOutputStream();
+                byte[] buffer = new byte[8192];
+                int read;
+                while ((read = input.read(buffer)) != -1 && !doomed) {
+                    output.write(buffer, 0, read);
+                    output.flush();
+                }
+            } catch (IOException ignored) { // NOSONAR the connection is closed below in any case
+                // the peer went away, which ends the relaying just as well
+            }
+            close();
+        }
+
+        void relayResponses() {
+            try {
+                InputStream input = backend.getInputStream();
+                OutputStream output = client.getOutputStream();
+                byte[] buffer = new byte[8192];
+                int read;
+                while ((read = input.read(buffer)) != -1) {
+                    output.write(buffer, 0, read);
+                    output.flush();
+                }
+            } catch (IOException ignored) { // NOSONAR the connection is closed below in any case
+                // the peer went away, which ends the relaying just as well
+            }
+            close();
+        }
+
+        private void close() {
+            JOrphanUtils.closeQuietly(client);
+            JOrphanUtils.closeQuietly(backend);
+        }
+    }
+
+    private static HTTPSamplerBase newSampler() {
+        return HTTPSamplerFactory.newInstance("HttpClient5");
+    }
+
+    private static WireMockServer createServer() {
+        return new WireMockServer(WireMockConfiguration.wireMockConfig().dynamicPort());
+    }
+
+    private static boolean hasMethodReference(byte[] classBytes, String className, String methodName) throws IOException {
+        try (DataInputStream input = new DataInputStream(new ByteArrayInputStream(classBytes))) {
+            input.readInt();
+            input.readUnsignedShort();
+            input.readUnsignedShort();
+            int constantPoolCount = input.readUnsignedShort();
+            int[] tags = new int[constantPoolCount];
+            int[] firstReferences = new int[constantPoolCount];
+            int[] secondReferences = new int[constantPoolCount];
+            String[] utf8Values = new String[constantPoolCount];
+            int i = 1;
+            while (i < constantPoolCount) {
+                tags[i] = input.readUnsignedByte();
+                switch (tags[i]) {
+                case 1:
+                    utf8Values[i] = input.readUTF();
+                    break;
+                case 3:
+                case 4:
+                    input.readInt();
+                    break;
+                case 5:
+                case 6:
+                    input.readLong();
+                    i++;
+                    break;
+                case 7:
+                case 8:
+                case 16:
+                case 19:
+                case 20:
+                    firstReferences[i] = input.readUnsignedShort();
+                    break;
+                case 9:
+                case 10:
+                case 11:
+                case 12:
+                case 17:
+                case 18:
+                    firstReferences[i] = input.readUnsignedShort();
+                    secondReferences[i] = input.readUnsignedShort();
+                    break;
+                case 15:
+                    input.readUnsignedByte();
+                    firstReferences[i] = input.readUnsignedShort();
+                    break;
+                default:
+                    throw new IOException("Unknown class-file constant-pool tag " + tags[i]);
+                }
+                i++;
+            }
+            for (int methodReferenceIndex = 1; methodReferenceIndex < constantPoolCount; methodReferenceIndex++) {
+                if (tags[methodReferenceIndex] != 10) {
+                    continue;
+                }
+                int classIndex = firstReferences[methodReferenceIndex];
+                int nameAndTypeIndex = secondReferences[methodReferenceIndex];
+                String referencedClass = utf8Values[firstReferences[classIndex]];
+                String referencedMethod = utf8Values[firstReferences[nameAndTypeIndex]];
+                if (className.equals(referencedClass) && methodName.equals(referencedMethod)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+    }
+}
diff --git a/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPJavaFeatures.java b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPJavaFeatures.java
new file mode 100644
index 00000000000..280eece0b69
--- /dev/null
+++ b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPJavaFeatures.java
@@ -0,0 +1,538 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jmeter.protocol.http.sampler;
+
+import static com.github.tomakehurst.wiremock.client.WireMock.aResponse;
+import static com.github.tomakehurst.wiremock.client.WireMock.get;
+import static com.github.tomakehurst.wiremock.client.WireMock.post;
+import static com.github.tomakehurst.wiremock.client.WireMock.urlEqualTo;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.net.Socket;
+import java.net.URI;
+import java.net.URL;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509ExtendedTrustManager;
+
+import org.apache.jmeter.protocol.http.control.Header;
+import org.apache.jmeter.protocol.http.control.HeaderManager;
+import org.apache.jmeter.protocol.http.util.HTTPConstants;
+import org.apache.jmeter.samplers.SampleResult;
+import org.junit.jupiter.api.Test;
+
+import com.github.tomakehurst.wiremock.WireMockServer;
+import com.github.tomakehurst.wiremock.core.WireMockConfiguration;
+
+class TestHTTPJavaFeatures {
+
+    @Test
+    void usesHttpClientVersionWhenSamplerVersionIsEmpty() {
+        assertTrue(HTTPJavaImpl.isHttp2("", "HTTP/2"));
+        assertFalse(HTTPJavaImpl.isHttp2("", "HTTP/1.1"));
+    }
+
+    @Test
+    void usesSamplerHttpVersionWhenSpecified() {
+        assertFalse(HTTPJavaImpl.isHttp2("HTTP/1.1", "HTTP/2"));
+        assertTrue(HTTPJavaImpl.isHttp2("HTTP/2", "HTTP/1.1"));
+    }
+
+    @Test
+    void defaultsToHttp11ForUnsupportedHttpVersion() {
+        assertFalse(HTTPJavaImpl.isHttp2("HTTP/3", "HTTP/2"));
+    }
+
+    @Test
+    void usesHttp2WhenSelected() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/http2")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/http2")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertEquals("HTTP/2", result.getResponseHeaders().substring(0, "HTTP/2".length()));
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsResponseMessageForHttp2() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/http2ResponseMessage")).willReturn(aResponse().withStatus(404)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/http2ResponseMessage")), HTTPConstants.GET, false, 1);
+
+            assertEquals("404", result.getResponseCode());
+            assertEquals("Not Found", result.getResponseMessage());
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void returnsEmptyReasonPhraseForUnknownStatusCode() {
+        assertEquals("OK", HTTPJavaImpl.getReasonPhrase(200));
+        assertEquals("", HTTPJavaImpl.getReasonPhrase(599));
+    }
+
+    @Test
+    void mapsHttp2SettingsToJdkSystemProperties() {
+        Properties jmeterProperties = new Properties();
+        jmeterProperties.setProperty("http.java.h2.header_table_size", "8192");
+        jmeterProperties.setProperty("http.java.h2.max_concurrent_streams", "250");
+        jmeterProperties.setProperty("http.java.h2.initial_window_size", "65535");
+        jmeterProperties.setProperty("http.java.h2.connection_window_size", "1048576");
+        jmeterProperties.setProperty("http.java.h2.max_frame_size", "16384");
+        jmeterProperties.setProperty("http.java.h2.keep_alive_timeout", "60");
+        jmeterProperties.setProperty("http.java.h2.push_enabled", "true");
+        Properties systemProperties = new Properties();
+
+        HTTPJavaImpl.applyHttp2SystemProperties(jmeterProperties, systemProperties);
+
+        assertEquals("8192", systemProperties.getProperty("jdk.httpclient.hpack.maxheadertablesize"));
+        assertEquals("250", systemProperties.getProperty("jdk.httpclient.maxstreams"));
+        assertEquals("65535", systemProperties.getProperty("jdk.httpclient.windowsize"));
+        assertEquals("1048576", systemProperties.getProperty("jdk.httpclient.connectionWindowSize"));
+        assertEquals("16384", systemProperties.getProperty("jdk.httpclient.maxframesize"));
+        assertEquals("60", systemProperties.getProperty("jdk.httpclient.keepalive.timeout.h2"));
+        assertEquals("1", systemProperties.getProperty("jdk.httpclient.enablepush"));
+    }
+
+    @Test
+    void disablesServerPushAndKeepsJdkDefaultsWhenNothingIsConfigured() {
+        Properties systemProperties = new Properties();
+
+        HTTPJavaImpl.applyHttp2SystemProperties(new Properties(), systemProperties);
+
+        assertEquals("0", systemProperties.getProperty("jdk.httpclient.enablepush"));
+        assertNull(systemProperties.getProperty("jdk.httpclient.hpack.maxheadertablesize"));
+        assertNull(systemProperties.getProperty("jdk.httpclient.windowsize"));
+    }
+
+    @Test
+    void doesNotOverrideHttp2SettingsGivenOnTheCommandLine() {
+        Properties jmeterProperties = new Properties();
+        jmeterProperties.setProperty("http.java.h2.header_table_size", "8192");
+        Properties systemProperties = new Properties();
+        systemProperties.setProperty("jdk.httpclient.hpack.maxheadertablesize", "4096");
+        systemProperties.setProperty("jdk.httpclient.enablepush", "1");
+
+        HTTPJavaImpl.applyHttp2SystemProperties(jmeterProperties, systemProperties);
+
+        assertEquals("4096", systemProperties.getProperty("jdk.httpclient.hpack.maxheadertablesize"));
+        assertEquals("1", systemProperties.getProperty("jdk.httpclient.enablepush"));
+    }
+
+    @Test
+    void sharesHttp2ClientsBetweenThreadsForMultiplexing() throws Exception {
+        Map<?, ?> clientsOfMainThread = HTTPJavaImpl.getHttp2Clients();
+        AtomicReference<Map<?, ?>> clientsOfOtherThread = new AtomicReference<>();
+
+        Thread thread = new Thread(() -> clientsOfOtherThread.set(HTTPJavaImpl.getHttp2Clients()));
+        thread.start();
+        thread.join();
+
+        assertSame(clientsOfMainThread, clientsOfOtherThread.get(),
+                "HTTP/2 clients should be shared, so concurrent requests are multiplexed over one connection");
+    }
+
+    @Test
+    void multiplexesConcurrentHttp2RequestsOverOneConnection() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/multiplexed"))
+                    .willReturn(aResponse().withStatus(200).withFixedDelay(200).withBody("multiplexed")));
+
+            int requests = 4;
+            ExecutorService executor = Executors.newFixedThreadPool(requests);
+            try {
+                List<Future<HTTPSampleResult>> results = new ArrayList<>();
+                for (int i = 0; i < requests; i++) {
+                    results.add(executor.submit(() -> {
+                        HTTPSamplerBase sampler = newSampler();
+                        sampler.setHttpVersion("HTTP/2");
+                        return sampler.sample(
+                                new URL(server.url("/multiplexed")), HTTPConstants.GET, false, 1);
+                    }));
+                }
+                for (Future<HTTPSampleResult> result : results) {
+                    HTTPSampleResult sampleResult = result.get(60, TimeUnit.SECONDS);
+                    assertEquals("200", sampleResult.getResponseCode());
+                    assertTrue(sampleResult.getResponseHeaders().startsWith("HTTP/2"),
+                            "Response should have been received over HTTP/2, but was "
+                                    + sampleResult.getResponseHeaders());
+                }
+            } finally {
+                executor.shutdownNow();
+            }
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void recordsConnectTimeForEveryMultiplexedSample() throws Exception {
+        HTTPJavaImpl.ConnectTimeTracker tracker = new HTTPJavaImpl.ConnectTimeTracker();
+        SampleResult first = new SampleResult();
+        SampleResult second = new SampleResult();
+        first.sampleStart();
+        second.sampleStart();
+        tracker.sampleStarted(first);
+        tracker.sampleStarted(second);
+
+        Thread.sleep(5);
+        tracker.connectionEstablished();
+        Thread.sleep(5);
+
+        first.sampleEnd();
+        second.sampleEnd();
+        tracker.sampleFinished(first);
+        tracker.sampleFinished(second);
+
+        assertTrue(first.getConnectTime() > 0, "connectTime of the first sample should have been recorded");
+        assertTrue(second.getConnectTime() > 0, "connectTime of the second sample should have been recorded");
+        assertTrue(first.getConnectTime() <= first.getTime());
+        assertTrue(second.getConnectTime() <= second.getTime());
+    }
+
+    @Test
+    void ignoresSamplesWhichAreNoLongerInFlight() {
+        HTTPJavaImpl.ConnectTimeTracker tracker = new HTTPJavaImpl.ConnectTimeTracker();
+        SampleResult result = new SampleResult();
+        result.sampleStart();
+        tracker.sampleStarted(result);
+        tracker.sampleFinished(result);
+
+        tracker.connectionEstablished();
+        result.sampleEnd();
+
+        assertEquals(0, result.getConnectTime());
+    }
+
+    @Test
+    void usesHttp2WithProxy() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/http2proxy")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+            sampler.setProxyHost("localhost");
+            sampler.setProxyPortInt(Integer.toString(server.port()));
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/http2proxy")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsSentBytesCorrectlyForGetRequest() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/sentBytesGet")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/1.1");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/sentBytesGet")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getSentBytes() > 0, "sentBytes should be greater than 0");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsSentBytesCorrectlyForPostRequest() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(post(urlEqualTo("/sentBytesPost")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/1.1");
+            sampler.setPostBodyRaw(true);
+            sampler.addNonEncodedArgument("", "hello world", "");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/sentBytesPost")), HTTPConstants.POST, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getSentBytes() > "hello world".length(), "sentBytes should include request line, headers, and body");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsSentBytesCorrectlyForHttp2GetRequest() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/http2SentBytesGet")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/http2SentBytesGet")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getSentBytes() > 0, "sentBytes should be greater than 0");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsSentBytesCorrectlyForHttp2PostRequest() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(post(urlEqualTo("/http2SentBytesPost")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+            sampler.setPostBodyRaw(true);
+            sampler.addNonEncodedArgument("", "hello world http2", "");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/http2SentBytesPost")), HTTPConstants.POST, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getSentBytes() > "hello world http2".length(), "sentBytes should include request line, headers, and body");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void displaysAuthorizationHeaderFromHeaderManagerInHttp11() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/authHttp11")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/1.1");
+            HeaderManager headerManager = new HeaderManager();
+            headerManager.add(new Header("Authorization", "Bearer my-secret-token"));
+            sampler.setHeaderManager(headerManager);
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/authHttp11")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getRequestHeaders().contains("Authorization: Bearer my-secret-token"),
+                    "Request headers should contain Authorization header set in HeaderManager");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void displaysAuthorizationHeaderFromHeaderManagerInHttp2() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/authHttp2")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+            HeaderManager headerManager = new HeaderManager();
+            headerManager.add(new Header("Authorization", "Bearer my-secret-token-http2"));
+            sampler.setHeaderManager(headerManager);
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/authHttp2")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getRequestHeaders().contains("Authorization: Bearer my-secret-token-http2"),
+                    "Request headers should contain Authorization header set in HeaderManager");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsConnectTimeForHttp11() throws Exception {
+        WireMockServer server = new WireMockServer(WireMockConfiguration.wireMockConfig().dynamicHttpsPort());
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/connectTime")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/1.1");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL("https://localhost:" + server.httpsPort() + "/connectTime"), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getConnectTime() > 0,
+                    "connectTime should be greater than 0, but was " + result.getConnectTime());
+            assertTrue(result.getConnectTime() <= result.getTime(),
+                    "connectTime should not exceed the elapsed time");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsConnectTimeForHttp2OverPlainConnection() throws Exception {
+        WireMockServer server = createServer();
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/http2ConnectTime")).willReturn(aResponse().withStatus(200)));
+            HTTPSamplerBase sampler = newSampler();
+            sampler.setHttpVersion("HTTP/2");
+
+            HTTPSampleResult result = sampler.sample(
+                    new URL(server.url("/http2ConnectTime")), HTTPConstants.GET, false, 1);
+
+            assertEquals("200", result.getResponseCode());
+            assertTrue(result.getConnectTime() > 0,
+                    "connectTime should be greater than 0, but was " + result.getConnectTime());
+            assertTrue(result.getConnectTime() <= result.getTime(),
+                    "connectTime should not exceed the elapsed time");
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    void setsConnectTimeForHttp2OverTls() throws Exception {
+        WireMockServer server = new WireMockServer(
+                WireMockConfiguration.wireMockConfig().dynamicHttpsPort().http2TlsDisabled(false));
+        server.start();
+        try {
+            server.stubFor(get(urlEqualTo("/http2TlsConnectTime")).willReturn(aResponse().withStatus(200)));
+
+            HTTPJavaImpl.ConnectTimeTracker tracker = new HTTPJavaImpl.ConnectTimeTracker();
+            SSLContext sslContext = trustAllContext();
+            HttpClient client = HttpClient.newBuilder()
+                    .version(HttpClient.Version.HTTP_2)
+                    .sslContext(new HTTPJavaImpl.ConnectTimeMeasuringSSLContext(sslContext, tracker))
+                    .build();
+
+            SampleResult result = new SampleResult();
+            result.sampleStart();
+            tracker.sampleStarted(result);
+            HttpResponse<String> response;
+            try {
+                response = client.send(
+                        HttpRequest.newBuilder(URI.create(
+                                "https://localhost:" + server.httpsPort() + "/http2TlsConnectTime")).build(),
+                        HttpResponse.BodyHandlers.ofString());
+            } finally {
+                tracker.sampleFinished(result);
+            }
+            result.sampleEnd();
+
+            assertEquals(200, response.statusCode());
+            assertEquals(HttpClient.Version.HTTP_2, response.version());
+            assertTrue(result.getConnectTime() > 0,
+                    "connectTime should be greater than 0, but was " + result.getConnectTime());
+            assertTrue(result.getConnectTime() <= result.getTime(),
+                    "connectTime should not exceed the elapsed time");
+        } finally {
+            server.stop();
+        }
+    }
+
+    private static SSLContext trustAllContext() throws Exception {
+        TrustManager trustAll = new X509ExtendedTrustManager() {
+            @Override
+            public void checkClientTrusted(X509Certificate[] chain, String authType) {
+                // trust everything in the test
+            }
+
+            @Override
+            public void checkServerTrusted(X509Certificate[] chain, String authType) {
+                // trust everything in the test
+            }
+
+            @Override
+            public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) {
+                // trust everything in the test
+            }
+
+            @Override
+            public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) {
+                // trust everything in the test
+            }
+
+            @Override
+            public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) {
+                // trust everything in the test
+            }
+
+            @Override
+            public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) {
+                // trust everything in the test
+            }
+
+            @Override
+            public X509Certificate[] getAcceptedIssuers() {
+                return new X509Certificate[0];
+            }
+        };
+        SSLContext context = SSLContext.getInstance("TLS");
+        context.init(null, new TrustManager[] { trustAll }, null);
+        return context;
+    }
+
+    private static HTTPSamplerBase newSampler() {
+        return HTTPSamplerFactory.newInstance("Java");
+    }
+
+    private static WireMockServer createServer() {
+        return new WireMockServer(WireMockConfiguration.wireMockConfig().dynamicPort());
+    }
+}
diff --git a/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPSamplerFactory.java b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPSamplerFactory.java
new file mode 100644
index 00000000000..fc4387ab795
--- /dev/null
+++ b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/sampler/TestHTTPSamplerFactory.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jmeter.protocol.http.sampler;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.Arrays;
+
+import org.junit.jupiter.api.Test;
+
+public class TestHTTPSamplerFactory {
+
+    @Test
+    void httpClient5IsSelectable() {
+        assertTrue(Arrays.asList(HTTPSamplerFactory.getImplementations()).contains("HttpClient5"));
+
+        HTTPSamplerBase sampler = HTTPSamplerFactory.newInstance("HttpClient5");
+
+        assertEquals("HttpClient5", sampler.getImplementation());
+        assertInstanceOf(HTTPHC5Impl.class, HTTPSamplerFactory.getImplementation(sampler.getImplementation(), sampler));
+    }
+
+    @Test
+    void unknownImplementationIsRejected() {
+        assertThrows(IllegalArgumentException.class, () -> HTTPSamplerFactory.newInstance("HttpClient6"));
+    }
+
+    @Test
+    void httpVersionsMatchTheCapabilitiesOfTheImplementation() {
+        assertEquals(Arrays.asList("", "HTTP/1.1"),
+                Arrays.asList(HTTPSamplerFactory.getHttpVersions("HttpClient4")));
+        assertEquals(Arrays.asList("", "HTTP/1.1", "HTTP/2"),
+                Arrays.asList(HTTPSamplerFactory.getHttpVersions("Java")));
+        assertEquals(Arrays.asList("", "HTTP/1.1", "HTTP/2", "HTTP/2 Strict"),
+                Arrays.asList(HTTPSamplerFactory.getHttpVersions("HttpClient5")));
+    }
+
+    @Test
+    void httpVersionsOfBlankImplementationAreTheOnesOfTheDefaultImplementation() {
+        assertEquals(Arrays.asList(HTTPSamplerFactory.getHttpVersions(HTTPSamplerFactory.DEFAULT_CLASSNAME)),
+                Arrays.asList(HTTPSamplerFactory.getHttpVersions("")));
+    }
+}
diff --git a/xdocs/changes.xml b/xdocs/changes.xml
index 988377c81b1..bbc3537bc21 100644
--- a/xdocs/changes.xml
+++ b/xdocs/changes.xml
@@ -83,6 +83,17 @@ Summary
     <li><issue>6267</issue><pr>6268</pr>Add a space between key and value after <code>:</code> in View Results Tree &gt; Sampler result tab for better readability.</li>
   </ul>
 
+  <p>HTTP/2 support for the HttpClient5 and Java sampler implementations:</p>
+  <ul>
+    <li><pr>6742</pr>Multiplex concurrent HTTP/2 requests of the HttpClient5 sampler implementation over a single connection, and make the HTTP/2 protocol settings (HPACK header table size and compression, maximum concurrent streams, flow control window, maximum frame size, server push and h2c prior knowledge) configurable with the new <code>httpclient5.h2.*</code> properties. Pooled connections are re-validated after the period of inactivity configured with the new <code>httpclient5.validate_after_inactivity</code> property, so a connection the server closed in between two samples is replaced instead of failing the next sample.</li>
+    <li><pr>6742</pr>Multiplex concurrent HTTP/2 requests of the Java sampler implementation over a single connection, and make the HTTP/2 protocol settings (HPACK header table size, maximum concurrent streams, flow control windows, maximum frame size, connection keep alive and server push) configurable with the new <code>http.java.h2.*</code> properties.</li>
+    <li><pr>6742</pr>Add the default <code>User-Agent</code> header of the HttpClient5 sampler implementation to the request itself, so it shows up in the sample result and in the sent bytes, and allow suppressing it with the new <code>httpclient5.default_user_agent_disabled</code> property, like <code>httpclient4.default_user_agent_disabled</code> does for HttpClient4.</li>
+    <li><pr>6742</pr>Add the default <code>User-Agent</code> header of the Java sampler implementation (<code>Java/A.B.C</code> for HTTP/1.1 and <code>Java-http-client/A.B.C</code> for HTTP/2) to the request itself, so the header the JDK sends anyway shows up in the sample result and in the sent bytes.</li>
+    <li><pr>6742</pr>Support the Kerberos mechanism of the HTTP Authorization Manager in the HttpClient5 sampler implementation. HttpClient 5 neither registers the <code>Negotiate</code> and <code>Kerberos</code> auth schemes nor prefers them by default, so they are now set up per request, and the request is executed with the JAAS subject the Authorization Manager logged the user in with. The <code>kerberos.spnego.strip_port</code>, <code>kerberos.spnego.use_canonical_host_name</code> and <code>kerberos.spnego.delegate_cred</code> properties are honoured as with HttpClient4.</li>
+    <li><pr>6742</pr>Answer a <code>Proxy-Authenticate: Negotiate</code> (SPNEGO/Kerberos) challenge of an enterprise proxy in the HttpClient5 sampler implementation, instead of failing the sample with <code>407 Proxy Authentication Required</code>. The negotiation based auth schemes are now offered to a proxy which has no user name configured, or which is covered by a Kerberos entry of the HTTP Authorization Manager, while a proxy with a configured user name keeps using the password based schemes.</li>
+    <li><pr>6742</pr>Offer only the HTTP versions the selected implementation can use in the <code>HTTP Version</code> combo box of the HTTP Request sampler and the HTTP Request Defaults: HttpClient4 offers <code>HTTP/1.1</code> only, as it ignores the HTTP version, Java adds <code>HTTP/2 Negotiate</code>, and HttpClient5 additionally offers the new <code>HTTP/2 Strict</code> value, which only offers <code>h2</code> during protocol negotiation, so a server without HTTP/2 support fails the sample instead of being used with HTTP/1.1.</li>
+  </ul>
+
   <h3>Timers, Assertions, Config, Pre- &amp; Post-Processors</h3>
   <ul>
     <li><issue>6448</issue>Support trailing empty default values in JSON Extractor so expressions like <code>${VAR:-}</code> are handled correctly. Contributed by Raul Almeida (github.com/ratacolita)</li>
@@ -98,6 +109,7 @@ Summary
     <li>Update json-path to 2.10.0 for JSON query expressions.</li>
     <li>Update Neo4j Java driver to 6.x for Bolt-based database tests.</li>
     <li>Update Rhino JavaScript engine to 1.8.0 for JSR-223 JavaScript execution.</li>
+    <li><pr>6742</pr>Update Apache HttpClient 5 to 5.6.4 and Apache HttpCore 5 to 5.4.3, which corrects the application of SSL parameters in the async TLS upgrade method used by the HttpClient5 sampler implementation for HTTP/2.</li>
   </ul>
 
   <h3>UI</h3>
@@ -116,6 +128,7 @@ Summary
     <li><pr>6620</pr>Fix report generation paths so dashboard output files are created in the correct location after internal refactoring.</li>
     <li><bug>6456</bug>Handle malformed percent-encoded URLs gracefully when recording HTTP traffic, logging a warning instead of failing the recording.</li>
   </ul>
+
  <!--  =================== Thanks =================== -->
 
 <ch_section>Thanks</ch_section>
@@ -127,6 +140,7 @@ Summary
   <li>Gabriele Coletta (github.com/gdmg92)</li>
   <li>Patrick Uiterwijk (patrick at puiterwijk.org)</li>
   <li>Piotr P. Karwasz (github.com/piotrgithub)</li>
+  <li>Andreas Lind (github.com/andreaslind01)</li>
 </ul>
 <p>We also thank bug reporters who helped us improve JMeter.</p>
 <ul>
diff --git a/xdocs/usermanual/component_reference.xml b/xdocs/usermanual/component_reference.xml
index 663b24fe6e4..9b7bdf4f4a7 100644
--- a/xdocs/usermanual/component_reference.xml
+++ b/xdocs/usermanual/component_reference.xml
@@ -142,6 +142,7 @@ Latency is set to the time it takes to login.
             <dt><code>Java</code></dt><dd>uses the HTTP implementation provided by the JVM.
             This has some limitations in comparison with the HttpClient implementations - see below.</dd>
             <dt><code>HTTPClient4</code></dt><dd>uses Apache HttpComponents HttpClient 4.x.</dd>
+            <dt><code>HTTPClient5</code></dt><dd>uses Apache HttpComponents HttpClient 5.x.</dd>
             <dt>Blank Value</dt><dd>does not set implementation on HTTP Samplers, so relies on HTTP Request Defaults if present or on <code>jmeter.httpsampler</code> property defined in <code>jmeter.properties</code></dd>
           </dl>
         </dd>
@@ -241,13 +242,20 @@ https.default.protocol=SSLv3
         <property name="Port" required="No, unless proxy hostname is specified">Port the proxy server is listening to.</property>
         <property name="Username" required="No">(Optional) username for proxy server.</property>
         <property name="Password" required="No">(Optional) password for proxy server. (N.B. this is stored unencrypted in the test plan)</property>
-        <property name="Implementation" required="No"><code>Java</code>, <code>HttpClient4</code>.
+        <property name="Implementation" required="No"><code>Java</code>, <code>HttpClient4</code>, <code>HttpClient5</code>.
         If not specified (and not defined by HTTP Request Defaults), the default depends on the value of the JMeter property
         <code>jmeter.httpsampler</code>, failing that, the HttpClient4 implementation is used.</property>
+        <property name="HTTP Version" required="No">The HTTP versions offered depend on the selected implementation:
+        <code>HttpClient5</code> supports <code>HTTP/1.1</code>, <code>HTTP/2 Negotiate</code> (stored as <code>HTTP/2</code>,
+        falls back to HTTP/1.1 when the server does not offer HTTP/2) and <code>HTTP/2 Strict</code> (stored as
+        <code>HTTP/2 Strict</code>, requires HTTP/2, so the request fails when the server does not support it),
+        <code>Java</code> supports <code>HTTP/1.1</code> and <code>HTTP/2 Negotiate</code>, and <code>HttpClient4</code>
+        supports <code>HTTP/1.1</code> only. An empty value uses the <code>httpclient.version</code> property, which
+        defaults to <code>HTTP/1.1</code>.</property>
         <property name="Protocol" required="No"><code>HTTP</code>, <code>HTTPS</code> or <code>FILE</code>. Default: <code>HTTP</code></property>
         <property name="Method" required="Yes"><code>GET</code>, <code>POST</code>, <code>HEAD</code>, <code>TRACE</code>,
           <code>OPTIONS</code>, <code>PUT</code>, <code>DELETE</code>, <code>PATCH</code> (not supported for
-          <code>JAVA</code> implementation). With <code>HttpClient4</code>, the following methods related to WebDav are
+          <code>JAVA</code> implementation). With <code>HttpClient4</code> or <code>HttpClient5</code>, the following methods related to WebDav are
           also allowed: <code>COPY</code>, <code>LOCK</code>, <code>MKCOL</code>, <code>MOVE</code>,
           <code>PROPFIND</code>, <code>PROPPATCH</code>, <code>UNLOCK</code>, <code>REPORT</code>, <code>MKCALENDAR</code>,
           <code>SEARCH</code>.
@@ -484,7 +492,7 @@ so the value may be greater than the number of bytes in the response content.
 </p>
 <p>
 <b>Retry handling</b><br></br>
-By default retry has been set to 0 for both HttpClient4 and Java implementations, meaning no retry is attempted.<br/>
+By default retry has been set to 0 for HttpClient4, HttpClient5 and Java implementations, meaning no retry is attempted.<br/>
 For HttpClient4, the retry count can be overridden by setting the relevant JMeter property, for example:
 
 <source>
@@ -3623,7 +3631,7 @@ By default, a Graphite implementation is provided.
 <component name="DNS Cache Manager" index="&sect-num;.4.3"  width="712" height="387" screenshot="dns-cache-manager.png">
     <note>DNS Cache Manager is designed for using in the root of Thread Group or Test Plan. Do not place it as child element of particular HTTP Sampler
     </note>
-    <note>DNS Cache Manager works only with HTTP requests using HTTPClient4 implementation.</note>
+    <note>DNS Cache Manager works only with HTTP requests using HTTPClient4 or HTTPClient5 implementation.</note>
     <description><p>The DNS Cache Manager element allows to test applications, which have several servers behind load balancers (CDN, etc.),
     when user receives content from different IP's. By default JMeter uses JVM DNS cache. That's why
     only one server from the cluster receives load. DNS Cache Manager resolves names for each thread separately each iteration and
@@ -3649,7 +3657,7 @@ By default, a Graphite implementation is provided.
     <p>The IP address for the test server will be looked up by using the custom DNS resolver. When none is given, the
     system DNS resolver will be used.
     </p>
-    <p>Now you can use <code>www.example.com</code> in your HTTPClient4 samplers and the requests will be made against
+    <p>Now you can use <code>www.example.com</code> in your HTTPClient4 or HTTPClient5 samplers and the requests will be made against
     <code>a123.another.example.org</code> with all headers set to <code>www.example.com</code>.
     </p>
     </example>
@@ -3683,14 +3691,14 @@ transmits the login information when it encounters this type of page.</p>
 The Authorization headers may not be shown in the Tree View Listener "<code>Request</code>" tab.
 The Java implementation does pre-emptive authentication, but it does not
 return the Authorization header when JMeter fetches the headers.
-The HttpComponents (HC 4.5.X) implementation defaults to pre-emptive since 3.2 and the header will be shown.
-To disable this, set the values as below, in which case authentication will only be performed in response to a challenge.
+The HttpComponents HC 4.5.X and HC 5.X implementations use pre-emptive Basic authentication and the header will be shown.
+To disable this for HttpClient4, set the value below, in which case authentication will only be performed in response to a challenge.
 </p>
 <p>
 In the file <code>jmeter.properties</code> set <code>httpclient4.auth.preemptive=false</code>
 </p>
 <note>
-Note: the above settings only apply to the HttpClient sampler.
+Note: the above setting applies only to HttpClient4.
 </note>
 <note>
 When looking for a match against a URL, JMeter checks each entry in turn, and stops when it finds the first match.
@@ -3719,6 +3727,7 @@ information for the user named, "<code>jmeter</code>".</property>
 <dl>
 <dt>Java</dt><dd><code>BASIC</code></dd>
 <dt>HttpClient 4</dt><dd><code>BASIC</code>, <code>DIGEST</code> and <code>Kerberos</code></dd>
+<dt>HttpClient 5</dt><dd><code>BASIC</code>, <code>DIGEST</code> and <code>Kerberos</code></dd>
 </dl>
 </property>
 </properties>
@@ -3912,7 +3921,7 @@ All port values are treated equally; a sampler that does not specify a port will
         <property name="Port" required="No">Port the web server is listening to.</property>
         <property name="Connect Timeout" required="No">Connection Timeout. Number of milliseconds to wait for a connection to open.</property>
         <property name="Response Timeout" required="No">Response Timeout. Number of milliseconds to wait for a response.</property>
-        <property name="Implementation" required="No"><code>Java</code>, <code>HttpClient4</code>.
+        <property name="Implementation" required="No"><code>Java</code>, <code>HttpClient4</code>, <code>HttpClient5</code>.
         If not specified the default depends on the value of the JMeter property
         <code>jmeter.httpsampler</code>, failing that, the <code>Java</code> implementation is used.</property>
         <property name="Protocol" required="No"><code>HTTP</code> or <code>HTTPS</code>.</property>
diff --git a/xdocs/usermanual/properties_reference.xml b/xdocs/usermanual/properties_reference.xml
index a40ae5027a6..3b8870d9e7a 100644
--- a/xdocs/usermanual/properties_reference.xml
+++ b/xdocs/usermanual/properties_reference.xml
@@ -442,8 +442,112 @@ JMETER-SERVER</source>
     Defaults to: <code>0</code>
 </property>
 <property name="httpclient.version">
-    Set the http version.<br/>
-    Defaults to: <code>1.1</code> (or use the parameter <code>http.protocol.version</code>)
+    Set the default HTTP version for HttpClient5 and Java samplers with an empty HTTP Version value.<br/>
+    Valid values are <code>HTTP/1.1</code>, <code>HTTP/2</code> and, for HttpClient5 only,
+    <code>HTTP/2 Strict</code>.<br/>
+    Defaults to: <code>HTTP/1.1</code>
+</property>
+<property name="httpclient5.validate_after_inactivity">
+    Milliseconds of inactivity after which a pooled connection of the HttpClient5 sampler
+    implementation is re-validated before it is reused, using an HTTP/2 <code>PING</code> or a stale
+    check for HTTP/1.1. <code>-1</code> disables the check. Without it a connection the server closed
+    while the thread was idle is reused as it is and fails the sample, as JMeter deliberately does not
+    retry requests.<br/>
+    Defaults to: <code>2000</code>
+</property>
+<property name="httpclient5.h2.multiplexing">
+    Multiplex concurrent message exchanges (for example parallel downloads of embedded resources)
+    over a single HTTP/2 connection.<br/>
+    Defaults to: <code>true</code>
+</property>
+<property name="httpclient5.h2.max_connections_per_route">
+    Maximum number of HTTP/2 connections kept per target host. With multiplexing enabled a single
+    connection usually serves all concurrent requests.<br/>
+    Defaults to: <code>6</code>
+</property>
+<property name="httpclient5.h2.header_table_size">
+    Size in bytes of the HPACK dynamic header table announced to the server.
+    <code>0</code> disables indexing of the headers by the server.<br/>
+    Defaults to: <code>8192</code>
+</property>
+<property name="httpclient5.h2.header_compression">
+    Compress the request headers with HPACK.<br/>
+    Defaults to: <code>true</code>
+</property>
+<property name="httpclient5.h2.max_concurrent_streams">
+    Maximum number of concurrent streams the client accepts on a single HTTP/2 connection.<br/>
+    Defaults to: <code>250</code>
+</property>
+<property name="httpclient5.h2.initial_window_size">
+    HTTP/2 flow control window in bytes announced per stream.<br/>
+    Defaults to: <code>65535</code>
+</property>
+<property name="httpclient5.h2.max_frame_size">
+    Largest HTTP/2 frame payload in bytes the client is willing to receive.<br/>
+    Defaults to: <code>65536</code>
+</property>
+<property name="httpclient5.h2.push_enabled">
+    Accept HTTP/2 server push. JMeter cannot report pushed resources, so they are dropped,
+    therefore push is disabled by default.<br/>
+    Defaults to: <code>false</code>
+</property>
+<property name="httpclient5.h2.prior_knowledge">
+    Use HTTP/2 over cleartext (h2c with prior knowledge) when <code>HTTP/2</code> is selected for a
+    <code>http://</code> URL. Without it such requests fall back to HTTP/1.1, because protocol
+    negotiation requires TLS. Only enable it if all plain HTTP targets support h2c.<br/>
+    Defaults to: <code>false</code>
+</property>
+<property name="httpclient5.default_user_agent_disabled">
+    If true, the default HC5 User-Agent (Apache-HttpClient/X.Y.Z (Java/A.B.C)) will not be added.
+    A User-Agent header defined in the test plan is still sent.<br/>
+    Defaults to: <code>false</code>
+</property>
+<property name="http.java.h2.multiplexing">
+    Multiplex concurrent message exchanges (for example the requests of different threads or parallel
+    downloads of embedded resources) of the Java sampler implementation over a single HTTP/2
+    connection per origin. Requests which start before the first HTTP/2 connection to a host has been
+    established still open a connection of their own.<br/>
+    Defaults to: <code>true</code>
+</property>
+<property name="http.java.h2.header_table_size">
+    Size in bytes of the HPACK dynamic header table the Java sampler implementation announces to the
+    server. <code>0</code> disables indexing of the headers by the server. It is applied as the
+    <code>jdk.httpclient.hpack.maxheadertablesize</code> system property.<br/>
+    Defaults to the JDK default: <code>16384</code>
+</property>
+<property name="http.java.h2.max_concurrent_streams">
+    Maximum number of server initiated (pushed) streams the Java sampler implementation accepts on a
+    single HTTP/2 connection. It is applied as the <code>jdk.httpclient.maxstreams</code> system
+    property.<br/>
+    Defaults to the JDK default: <code>100</code> with server push enabled, <code>0</code> otherwise
+</property>
+<property name="http.java.h2.initial_window_size">
+    HTTP/2 flow control window in bytes the Java sampler implementation announces per stream. It is
+    applied as the <code>jdk.httpclient.windowsize</code> system property.<br/>
+    Defaults to the JDK default: <code>16777216</code>
+</property>
+<property name="http.java.h2.connection_window_size">
+    HTTP/2 flow control window in bytes the Java sampler implementation announces for the whole
+    connection, it must not be smaller than the stream window. It is applied as the
+    <code>jdk.httpclient.connectionWindowSize</code> system property.<br/>
+    Defaults to the JDK default: <code>67108864</code>
+</property>
+<property name="http.java.h2.max_frame_size">
+    Largest HTTP/2 frame payload in bytes the Java sampler implementation is willing to receive,
+    between <code>16384</code> and <code>16777215</code>. It is applied as the
+    <code>jdk.httpclient.maxframesize</code> system property.<br/>
+    Defaults to the JDK default: <code>16384</code>
+</property>
+<property name="http.java.h2.keep_alive_timeout">
+    Seconds an idle HTTP/2 connection of the Java sampler implementation is kept in the pool. It is
+    applied as the <code>jdk.httpclient.keepalive.timeout.h2</code> system property.<br/>
+    Defaults to the JDK default: the value of <code>jdk.httpclient.keepalive.timeout</code>
+</property>
+<property name="http.java.h2.push_enabled">
+    Accept HTTP/2 server push in the Java sampler implementation. JMeter cannot report pushed
+    resources, so they are dropped, therefore push is disabled by default. It is applied as the
+    <code>jdk.httpclient.enablepush</code> system property.<br/>
+    Defaults to: <code>false</code>
 </property>
 <property name="httpclient.socket.http.cps">
     Set characters per second to a value greater then zero to emulate slow connections.<br/>
@@ -796,6 +900,8 @@ JMETER-SERVER</source>
         <dt><code>HTTPSampler2</code></dt>
         <dt><code>HttpClient4</code></dt>
         <dd>Use Apache HTTPClient version 4</dd>
+        <dt><code>HttpClient5</code></dt>
+        <dd>Use Apache HTTPClient version 5</dd>
     </dl>
     Defaults to: <code>HttpClient4</code>
 </property>