[SOLR-16963] verifyClientHostName is used incorrectly

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 8.4.1
• Fix Version/s: main (10.0), 9.4
• Component/s: http2, SolrJ
• Assignee: Houston Putman
• Reporter: Houston Putman
• Created: 07/Sep/23 16:05
• Updated: 12/Jan/24 19:12
• Resolved: 12/Jan/24 19:12

Description

Since SOLR-14163, the solr.jetty.ssl.verifyClientHostName and solr.ssl.checkPeerName options have done the exact same thing in the Http2SolrClient, which is control the EndpointIdentificationAlgorithm. 

Since solr.jetty.ssl.verifyClientHostName is checked second, that is actually the setting that is used to determine the EndpointIdentificationAlgorithm, so solr.ssl.checkPeerName is actually ignored.

Going forward I suggest that we stop our use of solr.jetty.ssl.verifyClientHostname, because it was added after solr.ssl.checkPeerName and its name is less correct. The endpointIdentificationAlgorithm doesn't do any verification of the client's hostname. That's a mTLS option, and is server-side.

Issue Links

• is caused by: SOLR-14163 SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION needs to work with Jetty server/client SSL contexts
• links to: GitHub Pull Request #1916