I started off following this post to setup TLS with a certificate with the PFX extension. An issue was revealed while trying to setup Solr replication; Wireshark showed Certificate Unknown when the secondary server made requests to the primary. This lead me down the path that Solr SSL/TLS needs to be configured.
- Solr running over http/8983
- Certificate configured in IIS and added to
- Rewrite rule in IIS to transfer traffic from
- Updated rewrite rule to use
set SOLR_SSL_ENABLED=true set SOLR_SSL_KEY_STORE=etc/wildcard.sxp.local.pfx set SOLR_SSL_KEY_STORE_PASSWORD=OriginalSecret123 set SOLR_SSL_KEY_STORE_TYPE=PKCS12 set SOLR_SSL_TRUST_STORE=etc/wildcard.sxp.local.pfx set SOLR_SSL_TRUST_STORE_PASSWORD=OriginalSecret123 set SOLR_SSL_TRUST_STORE_TYPE=PKCS12
The certificate was provided by our Security Team so we could add it to IIS and our load balancer. Once solr starts I see this error message:
Java java.io.IOException: Invalid keystore format
Apparently changing from jks to pkcs12 has this undesired affect.