thelabdude commented on issue #390: URL: https://github.com/apache/solr-operator/issues/390#issuecomment-1011288225
thanks Nik ... Solr is getting configured with the keystore as the truststore, which is likely the cause of the problem here (since once the new cert is loaded, it's not trusted by the other nodes). So there is a bug here in that the Solr operator should not set the truststore to the keystore and instead just have the JVM fallback to using cacerts. The source of this bug is that you want to use the keystore as truststore when using self-signed certs and I incorrectly applied that logic in all cases :-( I think an easy work-around for you for now is to just create a generic secret in your cluster(s) containing the Let's Encrypt Root CA for your truststore (pkcs12 format). You can download the CA pem files from here: https://letsencrypt.org/certificates/ Here's a script that does what you need, change the password ... it also imports all the CA certs that come with your JVM, so you'll need to point to a JAVA_HOME for your env before running this script: ``` #!/bin/bash # Pick a truststore password TRUST_STORE=truststore.p12 TRUST_STORE_PASSWORD=test1234 # Create a PKCS12 file containing all the CA Certs already trusted your JVM JAVA_HOME=TODO keytool -importkeystore -srckeystore $JAVA_HOME/jre/lib/security/cacerts -srcstorepass changeit \ -destkeystore $TRUST_STORE -deststoretype pkcs12 -deststorepass $TRUST_STORE_PASSWORD # Download the Let's Encrypt PEM file wget https://letsencrypt.org/certs/lets-encrypt-r3.pem # Import the Let's Encrypt Intermediate CA Cert into the truststore keytool -import -trustcacerts -alias letsencrypt -file lets-encrypt-r3.pem \ -keystore $TRUST_STORE -storepass $TRUST_STORE_PASSWORD # Verify the truststore is readable and the letsencrypt exists keytool -list -keystore $TRUST_STORE -storepass $TRUST_STORE_PASSWORD -storetype pkcs12 | grep letsencrypt # Create a k8s secret containing the truststore.p12 file and password literal kubectl create secret generic lets-encrypt-truststore-secret \ --from-file=truststore.p12=$TRUST_STORE \ --from-literal=password-key=$TRUST_STORE_PASSWORD ``` Once the `lets-encrypt-truststore-secret` exists, update your SolrCloud CRD definition to point to that secret ``` spec: solrTLS: ... trustStorePasswordSecret: name: lets-encrypt-truststore-secret key: password-key trustStoreSecret: name: lets-encrypt-truststore-secret key: truststore.p12 ``` sorry for the trouble here! Let me know if this work-around works for you for now and I'll get a fix into the next version of the operator that doesn't set the truststore to the keystore. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
