3

I have an Azure Load Balancer in front of two Solr servers in a Master/Slave configuration. This is a Sitecore 9 Update 1 build, so Solr is running SSL.

For the CD Servers that will be pointed to the Load Balancer they will hit an IP address (as its a Private Azure Load Balancer).

Example: https://192.16.0.1:8983/solr

The issue I am running against is that I cannot attach or install an SSL Certificate on the Load Balancer, and when the CD Servers go to talk to this endpoint that will route them to either Solr Master or Solr Slave, it wants a cert for the Load Balancer/sees its as an https endpoint.

Is there a method to skip the https validation of the load balancer and just have the Solr Servers validate the SSL/https?

3

I recommend you to use Azure Application Gateway for this purpose. You can assign a certificate to Application Gateway itself and also assign certificate (it may be even different one) for the requests that are forwarded from Application Gateway to particular endpoint.

One of the usual scenarios is to off-load SSL on Application Gateway and then forward traffic to endpoints over HTTP. In this case for security reason you obviously need to have your endpoints (master and slave solr instances) in virtual network.

In case you need some features of Azure Load Balancer that are not present in Application Gateway, you can put Application Gateway on front of Load Balancer (or vice versa) and let it handle SSL traffic for you.

I experimented a bit with SolrCloud (not master/slave) and also tried Application Gateway there. See this wiki for more information

  • I wish we could use AppGateways. Restricted to Azure Load Balancers – Kode Aug 20 '18 at 15:16
3

Other way:

use IIS on both servers as an reverse proxy with SSL offloading:

https://blogs.msdn.microsoft.com/friis/2016/08/25/setup-iis-with-url-rewrite-as-a-reverse-proxy-for-real-world-apps/ (make sure you read part 2 as well): https://blogs.msdn.microsoft.com/friis/2016/08/25/iis-with-url-rewrite-as-a-reverse-proxy-part-2-dealing-with-500-52-status-codes/

  • Please add the necessary details to the answer itself on what you recommend, not just links. – Jarmo Jarvi Aug 22 '18 at 19:52
  • Hi Gert, welcome to the Sitecore Stack Exchange. First, thanks for contributing and being a part of the community. Please take some time to read this post on Link Only Answers, while your answer does contain useful information, the guidelines for SSE are that the answer must contain the information without having to click away from the SSE site. Please update your answer to include all the relevant information. Thanks! – Richard Seal Aug 23 '18 at 0:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.