Setting/Enabling Solr as SSL for Sitecore 9.2/Sitecore 9.3

Solr can encrypt communications to and from clients, and between nodes in SolrCloud mode, with SSL.

Sitecore has changed their security model and hence Sitecore required SSL enabled Solr for their 9.0 onwards version.

Pre-Requisite:

    1. Install JRE :

           Make sure you have installed the JRE, if it not there then download from link:                         http://www.oracle.com/technetwork/java/javase/downloads/index.html 

    2. Download Solr :

           Download Solr version from below link. I used 7.5.0

          https://indy.fulgan.com/SSL/   

    3. OpenSSL

          Download OpenSSL from location

          http://gnuwin32.sourceforge.net/packages/openssl.htm

Note: Extract zip file of SSL and copy bin folder of JRE.

            4.  Setup Solr as Windows service

           Follow below link to install Solr as Windows Service:

          https://www.sitecorebites.net/2019/12/setup-solr-as-window-service.html

Follow below link to setup SSL without PowerShell script

         1. Generate a Self-Signed Certificate and a Key

To generate a self-signed certificate and a single key that will be used to authenticate both the server and the client, we’ll use the JDK keytool command and create a separate keystore. This keystore will also be used as a truststore below. It’s possible to use the keystore that comes with the JDK for these purposes, and to use a separate truststore, but those options aren’t covered here.

A)      Run the commands below in the server/etc/ directory in the binary Solr distribution.

“C:\Program Files\Java\jre1.8.0_221\bin\keytool.exe” -genkeypair -alias solr-ssl -keyalg RSA -keysize 2048 -keypass secret -storepass secret -validity 9999 -keystore solr-ssl.keystore.jks -ext SAN=DNS:localhost,IP:127.0.0.1 -dname “CN=localhost, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=Country”

    Note : The above command will create a keystore file named solr-ssl.keystore.jks in the current directory.

B)     It will prompt and ask to enter password : secret ( You can enter any password and remember it)

         2. Convert the Certificate and Key to PEM Format

          First convert the JKS keystore into PKCS12 format using keytool

    “C:\Program Files\Java\jre1.8.0_221\bin\keytool.exe”-importkeystore -srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.p12 -srcstoretype jks -deststoretype pkcs12

Note : The keytool application will prompt you to create a destination keystore password and for the source keystore password, which was set when creating the keystore ("secret" in the example shown above)

    3. Next convert the PKCS12 format keystore, including both the certificate and the key, into PEM format using 

“C:\Program Files\Java\jre1.8.0_221\bin\openssl.exe" pkcs12 -in solr-ssl.keystore.p12 -out solr-ssl.pem

        4. Set Common SSL-Related System Properties

      Open file bin\solr.in.cmd from bin folder of Solr and modify as below.

set SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks

set SOLR_SSL_KEY_STORE_PASSWORD=secret

set SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks

set SOLR_SSL_TRUST_STORE_PASSWORD=secret

set SOLR_SSL_NEED_CLIENT_AUTH=false

set SOLR_SSL_WANT_CLIENT_AUTH=false

  5.  Verify Server/etc folder and validate below 3 files 

    6.   Install the certificate                                                                                                             

       Double click on the generated solr-ssl.keystore.p12 file and follow the wizard to import the certificate. When you reach the Certificate Store window, make sure to place the certificate in the Trusted Root Certification Authorities.  

https://www.sitecorebites.net/2018/05/add-certificate-under-trusted-root.html

 7.  Post import the certificate, reset Sole service and browse the Solr URL using https.

Visit for more Info:

https://lucene.apache.org/solr/guide/7_6/enabling-ssl.html#convert-the-certificate-and-key-to-pem-format-for-use-with-curl

https://lucene.apache.org/solr/guide/8_1/enabling-ssl.html#convert-the-certificate-and-key-to-pem-format-for-use-with-curl