Configure SSL for Cloud Index Search Server (Solr)
Before you can begin, you must have a certificate and key converted into PEM format as a single file.
|
|
If a certificate-only file is not available, you can optionally generate one from the certificate and key file:
1. Convert the JKS keystore into PKCS12 format using the keytool utility:
keytool -importkeystore -srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.p12 -srcstoretype jks -deststoretype pkcs12
2. Convert the PKCS12 formatted keystore, including only the certificate and not the key, into PEM format using the openssl command:
openssl pkcs12 -nokeys -in solr-ssl.keystore.p12 -out solr-ssl.cacert.pem
|
Configure SSL for Solr
Configure the Windchill Index Search server for all nodes running Solr. Use the same certificate and key file for all nodes.
1. Copy the certificate (JKS) file to <Index_Search_Home>/solr/server/etc.
2. Set common SSL-related system properties.
To activate the SSL settings, uncomment and update the set of properties beginning with SOLR_SSL_* in the following file:
◦ Windows: bin\solr.in.cmd
For example:
◦ Unix: bin/solr.in.sh
For example:
Where <password> is the password given when creating the certificate.
3. Open a Windchill shell and execute the following command to set the protocol as HTTPS to be used by the index search client when it connects to the index search server:
xconfmanager -s wt.index.solrProtocol=https -t codebase/wt.properties -p
4. When Windchill is configured to use SSL, any Java client that is being used outside Windchill needs a certificate to connect.
As a result, you must import the certificate to the JVM that is being used by the Solr nodes in the Solr cloud. This allows the Solr nodes to connect to Windchill and download documents for indexing.
Add the certificate file to the JVM trust store (JDK/JVM of the Solr nodes).
a. Navigate to the Java location that is used by the Solr nodes to verify the path of the cacerts file under <JAVA_HOME>/lib/security.
b. Navigate to <JAVA_HOME>/bin to import the new certificate. Run the keytool utility as a user who has permission to write to cacerts:
keytool -import -file <certificate file> -alias <unique name> -keystore <path to cacerts file>
For example:
keytool -import -file D:\SolrWithSSL\solr-5.4.1\server\etc\solr-ssl.cacert.pem -alias Key_Alias -keystore ../lib/security/cacerts
5. Restart Windchill.
Configure SSL for Zookeeper
1. The urlScheme cluster-wide property needs to be set to https before any Solr node starts.
Open a command prompt and navigate to <INDEX_SEARCH_HOME>/solr/server/scripts/cloud-scripts, and then execute the following command:
◦ Windows:
zkcli.bat -zkhost <comma-separated list of Zookeeper hostname:port entries> -cmd clusterprop -name urlScheme -val https
For example:
zkcli.bat -zkhost host1.ptcnet.ptc.com:2181,host2.ptcnet.ptc.com:2182,host3.ptcnet.ptc.com:2183 -cmd clusterprop -name urlScheme -val https
◦ Unix:
sh zkcli.sh -zkhost <comma-separated list of Zookeeper hostname:port entries> -cmd clusterprop -name urlScheme -val https
For example:
sh zkcli.sh -zkhost host1.ptcnet.ptc.com:2181,host2.ptcnet.ptc.com:2182,host3.ptcnet.ptc.com:2183 -cmd clusterprop -name urlScheme -val https
|
|
The urlScheme command should be executed whenever the Zookeeper nodes are restarted.
|
2. Restart the Solr cloud (the Zookeeper nodes and Solr nodes) and then navigate to the Solr administrative interface to verify that Solr is running with SSL.
|
|
• Out of the box, Solr does not include any configuration for cipher suite, and it uses the default cipher suites provided by Jetty. For more information, see the applicable Jetty : The Definitive Reference (eclipse.dev). It is recommended to reference your internal security requirements and security policies for guidelines on use of secure cipher suites.
|
