topic Re: SOLR Tracker SSLHandshakeException in Alfresco Forum

SOLR Tracker SSLHandshakeException

garbetsp — Thu, 02 Feb 2017 22:22:46 GMT

The site is up and working for 5.1.g. However, the catalina.out log is peppered with gigabytes of the following:2017-02-02 16:17:30,049 ERROR [solr.tracker.AbstractTracker] [SolrTrackerScheduler_Worker-17] Tracking failedjavax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:

Re: SOLR Tracker SSLHandshakeException

jpotts — Fri, 03 Feb 2017 16:31:33 GMT

Alfresco ships with its own client cert that is used by the SOLR server to authenticate requests coming from Alfresco. The log messages you are seeing indicate that something is wrong with the client certificate that Alfresco and SOLR are using.

This setup depends on Tomcat config and a keystore that, by default, resides in the alf_data directory.

Did you install using the installer?

Is your keystore directory where Alfresco expects?

Did you make any changes to Tomcat's server.xml or other Tomcat config?

Did you re-generate the SOLR SSL Certificate? If so, did you change the certificate's DN? If so, did you make the same change in the Tomcat config?

Did you make any changes to the Solr cores or their configuration (they also point to the keystore)?

Re: SOLR Tracker SSLHandshakeException

garbetsp — Fri, 03 Feb 2017 17:12:15 GMT

> Did you install using the installer?

Yes

> Is your keystore directory where Alfresco expects?

Yes

> Did you make any changes to Tomcat's server.xml or other Tomcat config?

Yes, I installed my own keystore with my own SSL certification issued by a provided we're required to use. Further, I set it up to use 8443 for connections which was also required by our organization's network team. I noticed that SOLR used 8443, but that was via localhost.

> Did you re-generate the SOLR SSL Certificate? If so, did you change the certificate's DN? If so, did you make the same change in the Tomcat config?

I did not.

> Did you make any changes to the Solr cores or their configuration (they also point to the keystore)?

Can I just take the existing Alfresco keystore and add my cert to that? I think this is the root of the problem.

Re: SOLR Tracker SSLHandshakeException

jpotts — Fri, 03 Feb 2017 17:43:44 GMT

You could try adding your cert to the keystore. Far better would be to create a new Connector that is listening on 443 and use that for external connections hitting the server, or even better would be to install an HTTP server with mod_ajp and use that to handle SSL, which is the best and most common practice.

If you are going to use your own cert for SOLR, you have to edit tomcat-users.xml and set the cert DN.

You should also look at this doc which talks about how SOLR security is set up: Solr 4 security | Alfresco Documentation

Re: SOLR Tracker SSLHandshakeException

garbetsp — Mon, 06 Feb 2017 16:54:37 GMT

I ripped all certs out of Alfresco config and put Nginx in front of it. That was a lot smoother and cleaner.