I have an Azure Load Balancer in front of two Solr servers in a Master/Slave configuration. This is a Sitecore 9 Update 1 build, so Solr is running SSL.

For the CD Servers that will be pointed to the Load Balancer they will hit an IP address (as its a Private Azure Load Balancer).


The issue I am running against is that I cannot attach or install an SSL Certificate on the Load Balancer, and when the CD Servers go to talk to this endpoint that will route them to either Solr Master or Solr Slave, it wants a cert for the Load Balancer/sees its as an https endpoint.

Is there a method to skip the https validation of the load balancer and just have the Solr Servers validate the SSL/https?

3 Answers 3


I recommend you to use Azure Application Gateway for this purpose. You can assign a certificate to Application Gateway itself and also assign certificate (it may be even different one) for the requests that are forwarded from Application Gateway to particular endpoint.

One of the usual scenarios is to off-load SSL on Application Gateway and then forward traffic to endpoints over HTTP. In this case for security reason you obviously need to have your endpoints (master and slave solr instances) in virtual network.

In case you need some features of Azure Load Balancer that are not present in Application Gateway, you can put Application Gateway on front of Load Balancer (or vice versa) and let it handle SSL traffic for you.

I experimented a bit with SolrCloud (not master/slave) and also tried Application Gateway there. See this wiki for more information

  • I wish we could use AppGateways. Restricted to Azure Load Balancers
    – Kode
    Commented Aug 20, 2018 at 15:16

Other way:

use IIS on both servers as an reverse proxy with SSL offloading:

https://blogs.msdn.microsoft.com/friis/2016/08/25/setup-iis-with-url-rewrite-as-a-reverse-proxy-for-real-world-apps/ (make sure you read part 2 as well): https://blogs.msdn.microsoft.com/friis/2016/08/25/iis-with-url-rewrite-as-a-reverse-proxy-part-2-dealing-with-500-52-status-codes/

  • Please add the necessary details to the answer itself on what you recommend, not just links. Commented Aug 22, 2018 at 19:52
  • Hi Gert, welcome to the Sitecore Stack Exchange. First, thanks for contributing and being a part of the community. Please take some time to read this post on Link Only Answers, while your answer does contain useful information, the guidelines for SSE are that the answer must contain the information without having to click away from the SSE site. Please update your answer to include all the relevant information. Thanks!
    – Richard Seal
    Commented Aug 23, 2018 at 0:59

Solved this by installing the desired certificate onto the SOLR instances themselves as a PFX file. It should be exported from Windows' Certificates in mmc, with the private key, with password "secret" and encryption the default TripleDES-SHA1, which I believe are all required to work with SOLR. Then place the pfx file in your SOLR /etc/ folder. Add the following settings to the solr.in.cmd file:

set SOLR_SSL_KEY_STORE=etc/cert-solr.pfx
set SOLR_SSL_TRUST_STORE=etc/cert-solr.pfx

Then you can access SOLR over HTTPS port 8983 on any hostname trusted by the certificate (e.g. https://search.mydomain.com:8983/solr/ ).

An Azure Load Balancer setup that works is with a load balancer rule on port 8983 for both Port and Backend Port, health probe on HTTPS port 8983 on path "/solr/". Then ensure the host name is pointing to the Azure Load Balancer frontend IP (a hosts file entry will do).

Credit to https://blogs.perficient.com/2018/08/20/using-the-pkcs12-pfx-format-for-solr-ssl-security/ for pointing out how to bind PFX certificate to SOLR.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.