From 300e81b655398228aa25e2f5e77a518113b1ee40 Mon Sep 17 00:00:00 2001 From: Robert Muir Date: Sun, 29 Dec 2019 09:30:27 -0500 Subject: [PATCH] SOLR-14141: eliminate JKS keystore from solr ssl docs. Currently the documentation pretends to create a JKS keystore. It is only actually a JKS keystore on java 8: on java9+ it is a PKCS12 keystore with a .jks extension (because PKCS12 is the new java default). It works even though solr explicitly tells the JDK (SOLR_SSL_KEY_STORE_TYPE=JKS) that its JKS when it is in fact not, due to how keystore backwards compatibility was implemented. Fix docs to explicitly create a PKCS12 keystore with .p12 extension and so on instead of a PKCS12 keystore masquerading as a JKS one. This simplifies the SSL steps since the "conversion" step (which was doing nothing) from .JKS -> .P12 can be removed. --- solr/bin/solr.in.cmd | 4 +- solr/bin/solr.in.sh | 4 +- solr/server/etc/jetty-ssl.xml | 4 +- solr/solr-ref-guide/src/enabling-ssl.adoc | 37 +++++-------------- ...ring-solr-with-prometheus-and-grafana.adoc | 2 +- 5 files changed, 17 insertions(+), 34 deletions(-) diff --git a/solr/bin/solr.in.cmd b/solr/bin/solr.in.cmd index 3bb8fef4665..75752462548 100755 --- a/solr/bin/solr.in.cmd +++ b/solr/bin/solr.in.cmd @@ -141,8 +141,8 @@ REM SSL Certificates contain host/ip "peer name" information that is validated b REM this to false can be useful to disable these checks when re-using a certificate on many hosts REM set SOLR_SSL_CHECK_PEER_NAME=true REM Override Key/Trust Store types if necessary -REM set SOLR_SSL_KEY_STORE_TYPE=JKS -REM set SOLR_SSL_TRUST_STORE_TYPE=JKS +REM set SOLR_SSL_KEY_STORE_TYPE=PKCS12 +REM set SOLR_SSL_TRUST_STORE_TYPE=PKCS12 REM Uncomment if you want to override previously defined SSL values for HTTP client REM otherwise keep them commented and the above values will automatically be set for HTTP clients diff --git a/solr/bin/solr.in.sh b/solr/bin/solr.in.sh index d843ba22032..5528091405d 100644 --- a/solr/bin/solr.in.sh +++ b/solr/bin/solr.in.sh @@ -158,8 +158,8 @@ # this to false can be useful to disable these checks when re-using a certificate on many hosts #SOLR_SSL_CHECK_PEER_NAME=true # Override Key/Trust Store types if necessary -#SOLR_SSL_KEY_STORE_TYPE=JKS -#SOLR_SSL_TRUST_STORE_TYPE=JKS +#SOLR_SSL_KEY_STORE_TYPE=PKCS12 +#SOLR_SSL_TRUST_STORE_TYPE=PKCS12 # Uncomment if you want to override previously defined SSL values for HTTP client # otherwise keep them commented and the above values will automatically be set for HTTP clients diff --git a/solr/server/etc/jetty-ssl.xml b/solr/server/etc/jetty-ssl.xml index ac57b6b690f..3688c4c7159 100644 --- a/solr/server/etc/jetty-ssl.xml +++ b/solr/server/etc/jetty-ssl.xml @@ -18,8 +18,8 @@ - - + + diff --git a/solr/solr-ref-guide/src/enabling-ssl.adoc b/solr/solr-ref-guide/src/enabling-ssl.adoc index 4b403c6ea5a..ccfbf008d20 100644 --- a/solr/solr-ref-guide/src/enabling-ssl.adoc +++ b/solr/solr-ref-guide/src/enabling-ssl.adoc @@ -36,25 +36,14 @@ In addition to `localhost` and `127.0.0.1`, this example includes a LAN IP addre [source,bash] ---- -keytool -genkeypair -alias solr-ssl -keyalg RSA -keysize 2048 -keypass secret -storepass secret -validity 9999 -keystore solr-ssl.keystore.jks -ext SAN=DNS:localhost,IP:192.168.1.3,IP:127.0.0.1 -dname "CN=localhost, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=Country" +keytool -genkeypair -alias solr-ssl -keyalg RSA -keysize 2048 -keypass secret -storepass secret -validity 9999 -keystore solr-ssl.keystore.p12 -storetype PKCS12 -ext SAN=DNS:localhost,IP:192.168.1.3,IP:127.0.0.1 -dname "CN=localhost, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=Country" ---- -The above command will create a keystore file named `solr-ssl.keystore.jks` in the current directory. +The above command will create a keystore file named `solr-ssl.keystore.p12` in the current directory. === Convert the Certificate and Key to PEM Format for Use with curl -curl isn't capable of using JKS formatted keystores, so the JKS keystore needs to be converted to PEM format, which curl understands. - -First convert the JKS keystore into PKCS12 format using `keytool`: - -[source,bash] ----- -keytool -importkeystore -srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.p12 -srcstoretype jks -deststoretype pkcs12 ----- - -The keytool application will prompt you to create a destination keystore password and for the source keystore password, which was set when creating the keystore ("secret" in the example shown above). - -Next convert the PKCS12 format keystore, including both the certificate and the key, into PEM format using the http://www.openssl.org[`openssl`] command: +Convert the PKCS12 format keystore, including both the certificate and the key, into PEM format using the http://www.openssl.org[`openssl`] command: [source,bash] ---- @@ -82,9 +71,9 @@ NOTE: If you setup Solr as a service on Linux using the steps outlined in <