EDIT: SOLUTION: NEVER USE SPECIAL CHARACTERS IN YOUR SOLR.IN.CMD. IT WILL NOT WORK!
I have a certificate named "cert.pfx" from our organisation with the passwort "123456".
I want to use this file to enable https in Solr. I converted the pfx file to the desired .jks file:
keytool -importkeystore -srckeystore cert.pfx -srcstoretype pkcs12 -destkeystore solr-ssl.keystore.jks -deststoretype JKS
keytool -importkeystore -srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.jks.p12 -srcstoretype jks -deststoretype pkcs12
D:\openssl\openssl.exe pkcs12 -in solr-ssl.keystore.jks.p12 -out solr-ssl.pem
Output:
- solr-ssl.keystore.jks
- solr-ssl.keystore.jks.p12
- solr-ssl.pem
Solr.in.cmd file:
REM Enables HTTPS. It is implictly true if you set SOLR_SSL_KEY_STORE. Use this config
REM to enable https module with custom jetty configuration.
set SOLR_SSL_ENABLED=true
REM Uncomment to set SSL-related system properties
REM Be sure to update the paths to the correct keystore for your environment
set SOLR_SSL_KEY_STORE=D:\openssl\solr-ssl.keystore.jks
set SOLR_SSL_KEY_STORE_PASSWORD=123456
set SOLR_SSL_TRUST_STORE=D:\openssl\solr-ssl.keystore.jks
set SOLR_SSL_TRUST_STORE_PASSWORD=123456
REM Require clients to authenticate
set SOLR_SSL_NEED_CLIENT_AUTH=false
REM Enable clients to authenticate (but not require)
set SOLR_SSL_WANT_CLIENT_AUTH=false
REM Verify client hostname during SSL handshake
REM set SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION=false
REM SSL Certificates contain host/ip "peer name" information that is validated by default. Setting
REM this to false can be useful to disable these checks when re-using a certificate on many hosts
set SOLR_SSL_CHECK_PEER_NAME=true
REM Override Key/Trust Store types if necessary
set SOLR_SSL_KEY_STORE_TYPE=JKS
set SOLR_SSL_TRUST_STORE_TYPE=JKS
When I am trying to start Solr, I get the following error:
Caused by: java.security.PrivilegedActionException: java.io.IOException: Keystore was tampered with, or password was incorrect
at java.security.AccessController.doPrivileged(AccessController.java:738)
at org.eclipse.jetty.xml.XmlConfiguration.main(XmlConfiguration.java:1746)
... 7 more
Why do I get this error, when I clearly used "123456" in every step?