SOLR configurations for SSL communication?

[srinivasr]

Hi,

I have configured SSL in server.xml

 <Connector port="8443" URIEncoding="UTF-8" 
             protocol="org.apache.coyote.http11.Http11Protocol" 
             SSLEnabled="true"
                        maxThreads="150" 
                        scheme="https" 
                        keyAlias="test"
                   keystoreFile="/opt/alfresco-community/test.jks"
                   keystorePass="pass123"
                   keystoreType="JKS" 
           secure="true" connectionTimeout="240000" 
                        clientAuth="want" 
                        sslProtocol="TLS" 
                        allowUnsafeLegacyRenegotiation="true" 
                        maxHttpHeaderSize="32768" 
                        maxSavePostSize="-1" />  
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I could access alfresco through https but solr has lot of errors. Is there any configuration required for solr to have an SSL communication?

here are solr errros:

INFORMATION: Server startup in 55137 ms
2016-04-25 20:35:50,591  ERROR [solr.tracker.AbstractTracker] [SolrTrackerScheduler_Worker-2] Model tracking failed
 javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
        at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
        at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747)
        at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
        at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
        at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)


‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[hardik1512]

Try regenerating the certificates by running generate_keystores.bat(Windows) OR generate_keystores.sh(linux) file.

[srinivasr]

Thanks Hardik for your reply. The generate-keystores.sh is an older version that is bundled with 5.1. There is a jira ticket on that issue (https://issues.alfresco.com/jira/browse/MNT-16139).

Is there any other way to install the certificates?

We have our own certificate issued by godaddy, how do we install that certificate in solr4?

I have updated the server.xml with the certificate and I can launch alfresco through https but solr4 doesn't recognize as it uses its own keystores and truststores. The challenge is i am not able to find a good document on how to embed the certificates in solr4.

[srinivasr]

I have tried all the options available but no luck. how does generate-keystores solves the issue?

My last attempt was this:

1) Updated the certificate info in server.xml (mycompany.jks) - Can login to alfresco using https
2) Updated alfresco-global.properties with the below:

encryption.ssl.keystore.location=${dir.keystore}/ssl.keystore
encryption.ssl.keystore.type=JCEKS
encryption.ssl.keystore.keyMetaData.location=${dir.keystore}
encryption.ssl.keystore.provider=SunJCE

encryption.ssl.truststore.location =${dir.keystore}/ssl.truststore
encryption.ssl.truststore.type =JCEKS
encryption.ssl.truststore.keyMetaData.location=${dir.keystore}
encryption.ssl.truststore.provider=SunJCE
‍‍‍‍‍‍‍‍‍‍‍

Here are the errors after restarting the server (solr search doesn't work).

INFORMATION: Server startup in 73660 ms
2016-04-27 23:24:13,292  ERROR [solr.tracker.AbstractTracker] [SolrTrackerScheduler_Worker-1] Model tracking failed
 javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandsh
‍‍‍‍‍‍‍‍‍‍

[geovanny_campov]

Hello srinivasr,

I have bought my SSL certificate in Godaddy and I don't get mi certificate working.

Please, can you provide me some information about it? What I have to do? What files I have to modify in order to get my certificate working?

Thanks in advance for your help.

Regards,

Geova C.