14

So I'm working my way through the Sitecore 9 install instructions, and part of it is to install Solr with SSL. Since the install guide just refers you over to Solr, I've been following the instructions here: https://lucene.apache.org/solr/guide/6_6/enabling-ssl.html. After doing those steps and pointing the KEY_STORE and TRUST_STORE paths to the explicit paths to the .jks file, I can hit my local Solr with HTTPS, but Chrome comes back and says the connection is not secure.

Has anyone walked through these steps and have some guidance? I haven't done much with local SSL setups before, but it appears Sitecore is going there with this new install framework.

  • After creating the self-signed cert, I turned around and imported it into the Trusted Root Certification Authorities\Certificates using mmc \ Certifcates and did not have this issue. But, recommend using Kam's script posted below. :) – Radical Dave Oct 23 '17 at 15:44
16

Yes, this is normal Chrome behaviour. It recognises your certificate and does SSL, but it warns you that whoever issued the certificate is unknown (to Chrome) and therefore not trusted.

Trusted Certificate Authorities... well it's a long story. But not just anyone can issue a certificate, and have it show up all green in Chrome :-)

Funnily enough I had the same conversation in regards to Sitecore Commerce the other day on Slack, and Richard Szaslay was kind enough to share this PowerShell gem. I would suggest you create your certificate in this way.

#requires -Version 2.0

#region Exported Cmdlets

<#
    .SYNOPSIS
        Creates a self-signed certificate and copies it into the trusted store.
    .DESCRIPTION
        Creates a self-signed certificate and copies it into the trusted store.
    .PARAMETER DnsName
        The DNS name for which a certicate should be issued. eg mysite.local
    .EXAMPLE
        # New-TrustedSelfSignedCertificate mysite.local
        Description
        -----------
        Creates a self-signed certificate for mysite.local
#>
function New-TrustedSelfSignedCertificate {
    [CmdletBinding()]
    param (
        [Parameter(Position=0, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true, Mandatory=$true)]
        [String] $DnsName,

        [switch] $LocalMachine = $false
    )

    process {

        $ErrorActionPreference = "Stop"

        $cert = New-SelfSignedCertificate -DnsName $DnsName -CertStoreLocation Cert:\LocalMachine\My

        if ($LocalMachine) {
            $CertLocation = "LocalMachine";
        } else {
            $CertLocation = "CurrentUser";
        }

        # Cert provider does not support Copy-Item, so we'll copy it manually
        $dstStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", $CertLocation)
        $dstStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
        $dstStore.Add($cert)
        $dstStore.Close()
    }
}

#endregion

#region Module Interface
Export-ModuleMember New-TrustedSelfSignedCertificate
#endregion

Source: https://gist.github.com/richardszalay/9f28efcff249cc622658

  • Thanks, Mark. I'm definitely going to have to learn PowerShell in this brave new Sitecore world! – Ken McAndrew Oct 20 '17 at 0:48
  • Just to finish the process up, after you import this module and create an entry for your DNS name (I just used localhost), I had to export the key as a PFX file, then bring it into a JKS format for Solr to pick up. Found the answer here: stackoverflow.com/questions/4217107/… - use the JDK 1.6 or later instruction. Then like in the Solr SSL directions, uncomment those lines to point to the JKS file, and I got a green lock saying my Solr was secure. I'll try to write this up in a unified blog post for a complete reference. Thanks again! – Ken McAndrew Oct 20 '17 at 1:39
  • Looks like others have had the same issue...here's a new blog written on the topic, using the Solr instructions: himynameistim.wordpress.com/2017/10/20/…. Looks like the step I missed was double-clicking the p12 file to install the cert, like the export of the pfx file. – Ken McAndrew Oct 20 '17 at 18:07
9

Here's a script that will fully automate the generation of the JKS keystore for Solr as well:

https://gist.github.com/kamsar/c3c8322c1ec40eac64c7dd546e5124de

 # Usage:
 # This script is designed to be run after you have Solr running locally without SSL
 # It will generate a trusted, self-signed certificate for LOCAL DEV (this is useless for production)

 # Notes: The keystore must be under server/etc on Solr root, and MUST be named solr-ssl.keystore.jks
 # The cert will be added to locally trusted certs, so no security warnings in browsers
 # You must still reconfigure Solr to use the keystore and restart it after running this script
 #
 # THIS SCRIPT REQUIRES WINDOWS 10 (for the SSL trust)

 # License: MIT

 .\solrssl.ps1 -KeystoreFile C:\Solr\apache-solr\server\etc\solr-ssl.keystore.jks

Then the actual ps1 script:

param(
    [string]$KeystoreFile = 'solr-ssl.keystore.jks',
    [string]$KeystorePassword = 'secret',
    [string]$SolrDomain = 'localhost',
    [switch]$Clobber
)

$ErrorActionPreference = 'Stop'

### PARAM VALIDATION
if($KeystorePassword -ne 'secret') {
    Write-Error 'The keystore password must be "secret", because Solr apparently ignores the parameter'
}

if((Test-Path $KeystoreFile)) {
    if($Clobber) {
        Write-Host "Removing $KeystoreFile..."
        Remove-Item $KeystoreFile
    } else {
        $KeystorePath = Resolve-Path $KeystoreFile
        Write-Error "Keystore file $KeystorePath already existed. To regenerate it, pass -Clobber."
    }
}

$P12Path = [IO.Path]::ChangeExtension($KeystoreFile, 'p12')
if((Test-Path $P12Path)) {
    if($Clobber) {
        Write-Host "Removing $P12Path..."
        Remove-Item $P12Path
    } else {
        $P12Path = Resolve-Path $P12Path
        Write-Error "Keystore file $P12Path already existed. To regenerate it, pass -Clobber."
    }
}

try {
    $keytool = (Get-Command 'keytool.exe').Source
} catch {
    $keytool = Read-Host "keytool.exe not on path. Enter path to keytool (found in JRE bin folder)"

    if([string]::IsNullOrEmpty($keytool) -or -not (Test-Path $keytool)) {
        Write-Error "Keytool path was invalid."
    }
}

### DOING STUFF

Write-Host ''
Write-Host 'Generating JKS keystore...'
& $keytool -genkeypair -alias solr-ssl -keyalg RSA -keysize 2048 -keypass $KeystorePassword -storepass $KeystorePassword -validity 9999 -keystore $KeystoreFile -ext SAN=DNS:$SolrDomain,IP:127.0.0.1 -dname "CN=$SolrDomain, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=Country"

Write-Host ''
Write-Host 'Generating .p12 to import to Windows...'
& $keytool -importkeystore -srckeystore $KeystoreFile -destkeystore $P12Path -srcstoretype jks -deststoretype pkcs12 -srcstorepass $KeystorePassword -deststorepass $KeystorePassword

Write-Host ''
Write-Host 'Trusting generated SSL certificate...'
$secureStringKeystorePassword = ConvertTo-SecureString -String $KeystorePassword -Force -AsPlainText
$root = Import-PfxCertificate -FilePath $P12Path -Password $secureStringKeystorePassword -CertStoreLocation Cert:\LocalMachine\Root
Write-Host 'SSL certificate is now locally trusted. (added as root CA)'

Write-Host ''
Write-Host '########## NEXT STEPS ##########' -ForegroundColor Green
Write-Host ''
Write-Host '1. Copy your keystore to $SOLR_HOME\server\etc (MUST be here)' -ForegroundColor Green

if(-not $KeystoreFile.EndsWith('solr-ssl.keystore.jks')) {
    Write-Warning 'Your keystore file is not named "solr-ssl.keystore.jks"'
    Write-Warning 'Solr requires this exact name, so make sure to rename it before use.'
}

$KeystorePath = Resolve-Path $KeystoreFile
Write-Host ''
Write-Host '2. Add the following lines to your solr.in.cmd:' -ForegroundColor Green
Write-Host ''
Write-Host "set SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks" -ForegroundColor Yellow
Write-Host "set SOLR_SSL_KEY_STORE_PASSWORD=$KeystorePassword" -ForegroundColor Yellow
Write-Host "set SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks" -ForegroundColor Yellow
Write-Host "set SOLR_SSL_TRUST_STORE_PASSWORD=$KeystorePassword" -ForegroundColor Yellow
Write-Host ''
Write-Host 'Done!'
0

I faced similar issues while installing solr-7.5.0 for Sitecore 9.2 installation. I searched all over internet and it was written to import the certificate to trusted root authority.This solution worked for me. But please ensure that you check on below points -

a) make sure that you are importing it to trusted root authority of "LOCAL MACHINE" and not just "CURRENT USER". It will keep showing same error if you are importing only to "CURRENT USER".

b) make sure that more than 1 certificate with same name for solr does not exist in trusted root authority of "LOCAL MACHINE". This solution worked for me only when I deleted other certificates having same name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.