[
https://issues.apache.org/jira/browse/SOLR-18529?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18125851#comment-18125851
]
Jan Høydahl commented on SOLR-18529:
------------------------------------
I think ngrok/letsencrypt is the wrong shape here. There is no usecase for
putting a Solr instance on the public internet (which is a requirement for
letsencrypt). What we really want to do is make it easy for a developer to
setup a solr server with a generated certificate that the application can then
trust through a CA in the truststore.
I have done this multiple times with openssl, keytool and bash scripts. Not
that hard. It used to be very hairy, but with modern Java and BouncyCastle, I
think we can mint a CA cert and solr-server certs with pure java code. what
about adding a "TLS" tool?
{code:java}
bin/solr tls ca --out ca.p12 [--validity 3650] [--cn "Solr CA"]
bin/solr tls cert --ca ca.p12 --out solr1.p12 \
--dns solr1,localhost --ip 127.0.0.1 [--validity 825]
bin/solr tls trust --ca ca.p12 --out truststore.p12 [--pem ca.pem] {code}
Then you put solr1.p12 on the solr node, and the demo client app will use
truststore.p12 as truststore when talking to Solr.
> Wire in a ngrok/letsencrypt demo
> --------------------------------
>
> Key: SOLR-18529
> URL: https://issues.apache.org/jira/browse/SOLR-18529
> Project: Solr
> Issue Type: Sub-task
> Components: documentation
> Reporter: Eric Pugh
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
