[SOLR-14106] SSL with SOLR_SSL_NEED_CLIENT_AUTH not working since v8.2.0

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.2, 8.3, 8.3.1, 8.4
• Fix Version/s: 8.4.1, 8.5
• Component/s: Server
• Labels: jetty ssl
• Assignee: Kevin Risden
• Reporter: Jan Høydahl
• Created: 17/Dec/19 15:20
• Updated: 09/Feb/22 17:02
• Resolved: 30/Dec/19 21:43

Description

For a client we use SSL certificate authentication with Solr through the SOLR_SSL_NEED_CLIENT_AUTH=true setting. The client must then prove through a local pem file that it has the correct client certificate.

This works well until Solr 8.1.1, but fails with Solr 8.2 and also 8.3.1. There has been a Jetty upgrade from from jetty-9.4.14 to jetty-9.4.19 and I see some deprecation warnings in the log of 8.3.1:

o.e.j.x.XmlConfiguration Deprecated method public void org.eclipse.jetty.util.ssl.SslContextFactory.setWantClientAuth(boolean) in file:///opt/solr-8.3.1/server/etc/jetty-ssl.xml

I have made a simple reproduction script using Docker to reproduce first the 8.1.1 behaviour that succeeds, then 8.3.1 which fails:

wget https://www.dropbox.com/s/fkjcez1i5anh42i/tls.tgz
tar -xvzf tls.tgz
cd tls
./repro.sh

Issue Links

• causes: SOLR-14163 SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION needs to work with Jetty server/client SSL contexts
• contains: SOLR-14105 Http2SolrClient SSL not working in branch_8x
• is duplicated by: SOLR-14111 Revert SOLR-13541 which breaks SSL client auth
• is related to: SOLR-15999 Update SSL documentation for mutual TLS (mTLS)
• relates to: SOLR-13541 Upgrade Jetty to 9.4.19.v20190610
• links to: GitHub Pull Request #1094