Where to change SSL Thumbprint in Solr [closed]

Question

As I need to change the SSL Thumbprint in Solr configuration. I am new to Solr configration. Please help me to get the related configuration in Solr.

Thank you

Answer 1

If you want to use the Self Signed Cert, then follow the below steps:

1. Open a Windows PowerShell as an administrator and navigate to: <Path_to_Solr_Folder>\server\etc
2. Run this command in Windows PowerShell to create a Keystore file named solr-ssl.keystore.jks in the current directory.:

C:\'Program Files'\Java\jre1.8.0_191\bin\keytool.exe -genkeypair -alias solr-ssl -keyalg RSA -keysize 2048 -keypass secret -storepass secret -validity 9999 -keystore solr-ssl.keystore.jks -ext SAN=DNS:localhost,IP:127.0.0.1 -dname "CN=localhost, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=Country"

Check if solr-ssl.keystore.jks file is created in 'etc' folder.

You might get this warning while running the above command, which should be resolved in next step:

The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore 
-srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.jks -deststoretype pkcs12".

3. Run this command to Convert the Certificate and Key to PEM Format

C:\'Program Files'\Java\jre1.8.0_191\bin\keytool.exe -importkeystore -srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.p12 -srcstoretype jks -deststoretype pkcs12 -deststorepass secret -srcstorepass secret

You'll get this success message.

4. Import(double click) generated certificate file solr-ssl.keystore.p12 that was created in the ~\server\etc directory. Match the values below when prompt

• Store Location: Local Machine
• Password: secret
• Certificate store: Trusted Root Certificate Authorities

5. Update the ~\bin\solr.in.cmd file by pasting the following code block at the end of the file.

set SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks
set SOLR_SSL_KEY_STORE_PASSWORD=secret
set SOLR_SSL_KEY_STORE_TYPE=JKS
set SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks
set SOLR_SSL_TRUST_STORE_PASSWORD=secret
set SOLR_SSL_TRUST_STORE_TYPE=JKS
set SOLR_SSL_NEED_CLIENT_AUTH=false
set SOLR_SSL_WANT_CLIENT_AUTH=false

6. Add following Lines to ~\bin\solr.in.sh

SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks
SOLR_SSL_KEY_STORE_PASSWORD=secret
SOLR_SSL_KEY_STORE_TYPE=JKS
SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks
SOLR_SSL_TRUST_STORE_PASSWORD=secret
SOLR_SSL_TRUST_STORE_TYPE=JKS
SOLR_SSL_NEED_CLIENT_AUTH=false
SOLR_SSL_WANT_CLIENT_AUTH=false

7. Restart solr service.

If you want to use CA-signed certs

1. Convert your CA cert into .PFX and place it in <solr directory>/server/etc folder.
2. Update solr.in.cmd File <solr directory>/bin/solr.in.cmd

set SOLR_SSL_KEY_STORE=C:\<solr directory>\server\etc\new_solr_ssl_cert.pfx
set SOLR_SSL_KEY_STORE_PASSWORD=secret123
set SOLR_SSL_KEY_STORE_TYPE=PKCS12
set SOLR_SSL_TRUST_STORE=C:\<solr directory>\server\etc\new_solr_ssl_cert.pfx
set SOLR_SSL_TRUST_STORE_PASSWORD=secret123
set SOLR_SSL_TRUST_STORE_TYPE=PKCS12

3. Restart the Solr service.