[ https://issues.apache.org/jira/browse/SOLR-16735?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17709579#comment-17709579 ]
ASF subversion and git services commented on SOLR-16735: -------------------------------------------------------- Commit 76a7fa332404227fa8dd8cf1bb869ac9acad6d57 in solr's branch refs/heads/branch_9x from Tomas Eduardo Fernandez Lobbe [ https://gitbox.apache.org/repos/asf?p=solr.git;h=76a7fa33240 ] SOLR-16735: Allow custom configuration of Jetty's SecureRequestCustomizer (#1547) This change allows users that use TLS to configure Jetty's SecureRequestCustomizer using System properties on startup > "Invalid SNI" error when request server name doesn't match host certificate > --------------------------------------------------------------------------- > > Key: SOLR-16735 > URL: https://issues.apache.org/jira/browse/SOLR-16735 > Project: Solr > Issue Type: Bug > Security Level: Public(Default Security Level. Issues are Public) > Affects Versions: 9.2 > Reporter: Tomas Eduardo Fernandez Lobbe > Assignee: Tomas Eduardo Fernandez Lobbe > Priority: Major > Time Spent: 20m > Remaining Estimate: 0h > > Jetty 10 slightly changed the behavior for handling SNI validation. See > [Jetty9.4|https://github.com/eclipse/jetty.project/blob/jetty-9.4.x/jetty-server/src/main/java/org/eclipse/jetty/server/SecureRequestCustomizer.java#L262] > vs [Jetty > 10|https://github.com/eclipse/jetty.project/blob/jetty-10.0.x/jetty-server/src/main/java/org/eclipse/jetty/server/SecureRequestCustomizer.java#L242]. > In Jetty 9, by default (which Solr uses up to version 9.1), SNI extension > was not validated if not present, but in Jetty 10, by default, the host name > is validated against the host certificate, and {{400: Invalid SNI}} is thrown > if they don't match. > I think the right approach for Solr is to set {{sniHostCheck}} to {{false}}, > and at the most be the option to configure using jetty internal sysprops like > [here|https://github.com/eclipse/jetty.project/blob/jetty-10.0.x/jetty-server/src/main/config/etc/jetty-ssl.xml#L56-L61] > -- This message was sent by Atlassian Jira (v8.20.10#820010) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org For additional commands, e-mail: issues-h...@solr.apache.org