[SOLR-16735] "Invalid SNI" error when request server name doesn't match host certificate

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 9.2
• Fix Version/s: main (10.0), 9.3, 9.2.1
• Assignee: Tomas Eduardo Fernandez Lobbe
• Reporter: Tomas Eduardo Fernandez Lobbe
• Created: 03/Apr/23 19:31
• Updated: 01/May/23 15:27
• Resolved: 07/Apr/23 05:04

Description

Jetty 10 slightly changed the behavior for handling SNI validation. See Jetty9.4 vs Jetty 10. In Jetty 9, by default (which Solr uses up to version 9.1), SNI extension was not validated if not present, but in Jetty 10, by default, the host name is validated against the host certificate, and 400: Invalid SNI is thrown if they don't match.

I think the right approach for Solr is to set sniHostCheck to false, and at the most be the option to configure using jetty internal sysprops like here

Issue Links

• links to: GitHub Pull Request #1547