1

As I need to change the SSL Thumbprint in Solr configuration. I am new to Solr configration. Please help me to get the related configuration in Solr.

Thank you

2
  • Can you show what errors you are encountering? Commented Oct 3, 2022 at 2:47
  • No I am not getting any error because I have not changed it yet. I am unable to find the thumbprint configuration in Solr. Please let me know the configuration file name. @MichaelWest Commented Oct 3, 2022 at 2:51

1 Answer 1

1

If you want to use the Self Signed Cert, then follow the below steps:

  1. Open a Windows PowerShell as an administrator and navigate to: <Path_to_Solr_Folder>\server\etc
  2. Run this command in Windows PowerShell to create a Keystore file named solr-ssl.keystore.jks in the current directory.:
C:\'Program Files'\Java\jre1.8.0_191\bin\keytool.exe -genkeypair -alias solr-ssl -keyalg RSA -keysize 2048 -keypass secret -storepass secret -validity 9999 -keystore solr-ssl.keystore.jks -ext SAN=DNS:localhost,IP:127.0.0.1 -dname "CN=localhost, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=Country"

Check if solr-ssl.keystore.jks file is created in 'etc' folder.

You might get this warning while running the above command, which should be resolved in next step:

The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore 
-srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.jks -deststoretype pkcs12".
  1. Run this command to Convert the Certificate and Key to PEM Format
C:\'Program Files'\Java\jre1.8.0_191\bin\keytool.exe -importkeystore -srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.p12 -srcstoretype jks -deststoretype pkcs12 -deststorepass secret -srcstorepass secret

You'll get this success message. enter image description here

  1. Import(double click) generated certificate file solr-ssl.keystore.p12 that was created in the ~\server\etc directory. Match the values below when prompt
  • Store Location: Local Machine
  • Password: secret
  • Certificate store: Trusted Root Certificate Authorities
  1. Update the ~\bin\solr.in.cmd file by pasting the following code block at the end of the file.
set SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks
set SOLR_SSL_KEY_STORE_PASSWORD=secret
set SOLR_SSL_KEY_STORE_TYPE=JKS
set SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks
set SOLR_SSL_TRUST_STORE_PASSWORD=secret
set SOLR_SSL_TRUST_STORE_TYPE=JKS
set SOLR_SSL_NEED_CLIENT_AUTH=false
set SOLR_SSL_WANT_CLIENT_AUTH=false
  1. Add following Lines to ~\bin\solr.in.sh
SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks
SOLR_SSL_KEY_STORE_PASSWORD=secret
SOLR_SSL_KEY_STORE_TYPE=JKS
SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks
SOLR_SSL_TRUST_STORE_PASSWORD=secret
SOLR_SSL_TRUST_STORE_TYPE=JKS
SOLR_SSL_NEED_CLIENT_AUTH=false
SOLR_SSL_WANT_CLIENT_AUTH=false
  1. Restart solr service.

If you want to use CA-signed certs

  1. Convert your CA cert into .PFX and place it in <solr directory>/server/etc folder.
  2. Update solr.in.cmd File <solr directory>/bin/solr.in.cmd
set SOLR_SSL_KEY_STORE=C:\<solr directory>\server\etc\new_solr_ssl_cert.pfx
set SOLR_SSL_KEY_STORE_PASSWORD=secret123
set SOLR_SSL_KEY_STORE_TYPE=PKCS12
set SOLR_SSL_TRUST_STORE=C:\<solr directory>\server\etc\new_solr_ssl_cert.pfx
set SOLR_SSL_TRUST_STORE_PASSWORD=secret123
set SOLR_SSL_TRUST_STORE_TYPE=PKCS12
  1. Restart the Solr service.
2
  • Are there existing answers on SSE that you could of referenced? Perhaps your solution could have been answered on one of those and then question flagged as a duplicate. Commented Oct 3, 2022 at 12:16
  • Sure, @MichaelWest. Will do that :) Commented Oct 3, 2022 at 12:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.