[SOLR-13798] SSL: Adding Enabling/Disabling client's hostname verification config

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.2
• Fix Version/s: 8.3
• Assignee: Cao Manh Dat
• Reporter: Cao Manh Dat
• Created: 27/Sep/19 12:46
• Updated: 21/Jan/20 16:59
• Resolved: 30/Sep/19 15:31

Description

The problem for this after upgrading to Jetty 9.4.19 (SOLR-13541). endpointIdentificationAlgorithm changed from null → HTTPS. As a result of this client's hostname (identity) is always get verified on connecting Solr.

This change improved the security level of Solr, since it requires 2 ways identity verifications (client verify server's identity and vice versa). It leads to a problem when only certificate verification is enough (client's hostname is not known ahead) for users.

We should introduce a flag in solr.in.sh to disable client's hostname verification when needed then.

More about this at :

• https://tools.ietf.org/html/rfc2818#section-3
• https://github.com/eclipse/jetty.project/issues/3454
• https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf)

Issue Links

• is related to: SOLR-14163 SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION needs to work with Jetty server/client SSL contexts