1

looking for Azure experts advice!

I have about 1M AuthenticationExceptions while connecting to solr in the last few hours for almost non-active Sitecore instance...

I checked all the apps, they all have <add key="AllowInvalidClientCertificates" value="True" />, but this exception still popups. Looks like its having troubles connecting to solr: System.Security.Authentication.AuthenticationException at Sitecore.Xdb.Collection.Search.Solr.SolrClient+<SendGetRequestAsync>d__4.MoveNext Solr is running on a VM behind HTTPS, with self-signed certificate.

Also in the custom properties of the exception it says Application: XConnect. Checked those apps too, AllowInvalidClientCertificates also true there...

I'm running out of ideas where to look about... Any suggestions?

enter image description here

2

I also had this same problem. The trickiest part is figuring out which application is having the problem because the only information you get in Application Insights is xConnect for the application name.

Application Insights Exception

It took me some time to figure out which role was having the problem, especially because Sitecore in Azure PaaS is somewhat new to me. Once I figured out the specific role that was having the problem (xConnect Search [Index Worker Web Job ]), it was much easier to troubleshoot.

At first, I thought it was a connectivity issue between the Azure AppService and the VM that was running Solr. Then I thought it was an issue with the SSL certificate that we were using. It wasn't until I found this KB article from Sitecore that I understood that the self-signed certificate was not trusted by the index worker.

The solution involved multiple steps:

  1. Find the thumbprint of the SSL certificate that you are using for Solr.
  2. This should already be installed in the SSL Settings of the *-xc-search App Service. It might be private, but a public key is really all you need.
  3. Once you have the thumbprint, you have to add that string to a config file within the Index worker
  4. Open up your trusty Kudu console for the xConnect Search role and browse to: site\wwwroot\App_Data\jobs\continuous\IndexWorker\App_data\config\sitecore\CollectionSearch
  5. Edit the sc.Xdb.Collection.WebClient.SOLR.xml file Under
  6. Look for the Settings/Sitecore/XConnect/CollectionSearch/Services/ISolrWebClientFactory/Options/AcceptCertificates element
  7. If this element is empty, open it i.e.
<AcceptCertificates></AcceptCertificates>
  1. Inside that element, add another element named <thumbprint1> and paste your thumbprint inside.
  2. The thumbprint1 element should look like this:
<AcceptCertificates>
   <thumbprint1>your certificate thumbprint</thumbprint1>
</AcceptCertificates>
  1. Save your changes.
  2. Restart the IndexWorker web job

SIDE NOTE: If you need to add multiple thumbprints, you can add additional elements by incrementing the thumbprint count i.e. <thumbprint2>, <thumbprint3>, etc.

  • Thanks! Indeed, that was the solution. I have also had to set AcceptCertificates key in the same way for *-xc-collect web app in \App_Data\Config\Sitecore\CollectionSearch\sc.Xdb.Collection.WebClient.SOLR.xml config file – mcsdwarken Jun 7 at 12:12
2

Solr will need a valid certificate to run.

Ensure that https is enabled and properly set. You can check this in the solr.in.cmd file located in the solr\bin folder. Verify the following settings

REM Enables HTTPS. It is implictly true if you set SOLR_SSL_KEY_STORE. Use this config
REM to enable https module with custom jetty configuration.
set SOLR_SSL_ENABLED=true
REM Uncomment to set SSL-related system properties
REM Be sure to update the paths to the correct keystore for your environment
set SOLR_SSL_KEY_STORE=
set SOLR_SSL_KEY_STORE_PASSWORD=
set SOLR_SSL_KEY_STORE_TYPE=
set SOLR_SSL_TRUST_STORE=
set SOLR_SSL_TRUST_STORE_PASSWORD=
set SOLR_SSL_TRUST_STORE_TYPE=
set SOLR_SSL_NEED_CLIENT_AUTH=
set SOLR_SSL_WANT_CLIENT_AUTH=

If you need to generate a certificate, the following URL was a great help to me

https://kamsar.net/index.php/2017/10/Quickly-add-SSL-to-Solr/

you can also check the SOLR documentation as well

Once configured you should be able to browse to your SOLR URL in HTTPS

NOTE: After modifying the SOLR settings you will need to restart your SOLR windows service.

  • Solr does run on HTTPS , but on with self-signed certificate. I can access https:// myhostname/solr , but I have to approve that certificate authority is not trusted. All the settings you mentioned are set correctly. – mcsdwarken Jan 30 at 20:24
  • Is there anything in the SOLR/Apache logs? I also have SOLR running with a self Sign Cert. – Mikeyp Jan 31 at 17:57
  • thanks for an advice, I checked solr.log and there's nothing related to this issue. Which version of Sitecore and Solr are you running? – mcsdwarken Feb 5 at 9:56
  • I am in the process of upgrading to Sitecore 9.1 with SOLR 7.2.1. I have it running locally with a self signed cert. When I access the SOLR admin UI, I am not prompted to accept the cert. Since you are, that seems like there is a problem with the cert. Have you tried creating a new cert? – Mikeyp Feb 5 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.