0

I started off following this post to setup TLS with a certificate with the PFX extension. An issue was revealed while trying to setup Solr replication; Wireshark showed Certificate Unknown when the secondary server made requests to the primary. This lead me down the path that Solr SSL/TLS needs to be configured.

Initial setup:

  • Solr running over http/8983
  • Certificate configured in IIS and added to Cert:\LocalMachine\My
  • Rewrite rule in IIS to transfer traffic from https://scms.tst.sxp.local to http://127.0.0.1/solr

Modified setup:

  • Updated rewrite rule to use https://127.0.0.1/solr instead of http://127.0.0.1/solr
  • Updated solr.in.cmd
set SOLR_SSL_ENABLED=true
set SOLR_SSL_KEY_STORE=etc/wildcard.sxp.local.pfx
set SOLR_SSL_KEY_STORE_PASSWORD=OriginalSecret123
set SOLR_SSL_KEY_STORE_TYPE=PKCS12
set SOLR_SSL_TRUST_STORE=etc/wildcard.sxp.local.pfx
set SOLR_SSL_TRUST_STORE_PASSWORD=OriginalSecret123
set SOLR_SSL_TRUST_STORE_TYPE=PKCS12

The certificate was provided by our Security Team so we could add it to IIS and our load balancer. Once solr starts I see this error message:

Java java.io.IOException: Invalid keystore format

Apparently changing from jks to pkcs12 has this undesired affect.

1

After further investigation, it turns out that the original version of Java 8 (jdk8u222-b10-jre) used does not have proper support for PKCS12.

Steps to fix:

  • Download a newer version of Java
    • In my case I jumped up to Java 14 but you could get by with 12 (or maybe 11 (I'm not sure, just guessing))
  • Export the certificate with the private key using a different password (secret) and specifying TripleDES instead of AES256
    • Using TripleDES was revealed as an issue where the password was invalid

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.