Setting up SSL for Solr behind a Load Balancer on Azure

Question

I have an Azure Load Balancer in front of two Solr servers in a Master/Slave configuration. This is a Sitecore 9 Update 1 build, so Solr is running SSL.

For the CD Servers that will be pointed to the Load Balancer they will hit an IP address (as its a Private Azure Load Balancer).

Example: https://192.16.0.1:8983/solr

The issue I am running against is that I cannot attach or install an SSL Certificate on the Load Balancer, and when the CD Servers go to talk to this endpoint that will route them to either Solr Master or Solr Slave, it wants a cert for the Load Balancer/sees its as an https endpoint.

Is there a method to skip the https validation of the load balancer and just have the Solr Servers validate the SSL/https?

Answer 1

I recommend you to use Azure Application Gateway for this purpose. You can assign a certificate to Application Gateway itself and also assign certificate (it may be even different one) for the requests that are forwarded from Application Gateway to particular endpoint.

One of the usual scenarios is to off-load SSL on Application Gateway and then forward traffic to endpoints over HTTP. In this case for security reason you obviously need to have your endpoints (master and slave solr instances) in virtual network.

In case you need some features of Azure Load Balancer that are not present in Application Gateway, you can put Application Gateway on front of Load Balancer (or vice versa) and let it handle SSL traffic for you.

I experimented a bit with SolrCloud (not master/slave) and also tried Application Gateway there. See this wiki for more information

Answer 2

Other way:

use IIS on both servers as an reverse proxy with SSL offloading:

https://blogs.msdn.microsoft.com/friis/2016/08/25/setup-iis-with-url-rewrite-as-a-reverse-proxy-for-real-world-apps/ (make sure you read part 2 as well): https://blogs.msdn.microsoft.com/friis/2016/08/25/iis-with-url-rewrite-as-a-reverse-proxy-part-2-dealing-with-500-52-status-codes/

Answer 3

Solved this by installing the desired certificate onto the SOLR instances themselves as a PFX file. It should be exported from Windows' Certificates in mmc, with the private key, with password "secret" and encryption the default TripleDES-SHA1, which I believe are all required to work with SOLR. Then place the pfx file in your SOLR /etc/ folder. Add the following settings to the solr.in.cmd file:

set SOLR_SSL_KEY_STORE=etc/cert-solr.pfx
set SOLR_SSL_KEY_STORE_PASSWORD=secret
set SOLR_SSL_KEY_STORE_TYPE=PKCS12
set SOLR_SSL_TRUST_STORE=etc/cert-solr.pfx
set SOLR_SSL_TRUST_STORE_PASSWORD=secret
set SOLR_SSL_TRUST_STORE_TYPE=PKCS12 

Then you can access SOLR over HTTPS port 8983 on any hostname trusted by the certificate (e.g. https://search.mydomain.com:8983/solr/ ).

An Azure Load Balancer setup that works is with a load balancer rule on port 8983 for both Port and Backend Port, health probe on HTTPS port 8983 on path "/solr/". Then ensure the host name is pointing to the Azure Load Balancer frontend IP (a hosts file entry will do).

Credit to https://blogs.perficient.com/2018/08/20/using-the-pkcs12-pfx-format-for-solr-ssl-security/ for pointing out how to bind PFX certificate to SOLR.