How do you configure Solr 8.1.1 for TLS / SSL including replication with a PFX (PKCS12) certificate?

Question

I started off following this post to setup TLS with a certificate with the PFX extension. An issue was revealed while trying to setup Solr replication; Wireshark showed Certificate Unknown when the secondary server made requests to the primary. This lead me down the path that Solr SSL/TLS needs to be configured.

Initial setup:

• Solr running over http/8983
• Certificate configured in IIS and added to Cert:\LocalMachine\My
• Rewrite rule in IIS to transfer traffic from https://scms.tst.sxp.local to http://127.0.0.1/solr

Modified setup:

• Updated rewrite rule to use https://127.0.0.1/solr instead of http://127.0.0.1/solr
• Updated solr.in.cmd

set SOLR_SSL_ENABLED=true
set SOLR_SSL_KEY_STORE=etc/wildcard.sxp.local.pfx
set SOLR_SSL_KEY_STORE_PASSWORD=OriginalSecret123
set SOLR_SSL_KEY_STORE_TYPE=PKCS12
set SOLR_SSL_TRUST_STORE=etc/wildcard.sxp.local.pfx
set SOLR_SSL_TRUST_STORE_PASSWORD=OriginalSecret123
set SOLR_SSL_TRUST_STORE_TYPE=PKCS12

The certificate was provided by our Security Team so we could add it to IIS and our load balancer. Once solr starts I see this error message:

Java java.io.IOException: Invalid keystore format

Apparently changing from jks to pkcs12 has this undesired affect.

Answer 1

After further investigation, it turns out that the original version of Java 8 (jdk8u222-b10-jre) used does not have proper support for PKCS12.

Steps to fix:

• Download a newer version of Java
  • In my case I jumped up to Java 14 but you could get by with 12 (or maybe 11 (I'm not sure, just guessing))
• Export the certificate with the private key using a different password (secret) and specifying TripleDES instead of AES256
  • Using TripleDES was revealed as an issue where the password was invalid