[SOLR-16161] FIPS and Java 17.0.2 error on startup - server/NONE is not a valid keystore

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 8.11.1
• Component/s: security

Environment

Solr 8.11.1

java -version

openjdk version "17.0.2" 2022-01-18 LTS
OpenJDK Runtime Environment 21.9 (build 17.0.2+8-LTS)
OpenJDK 64-Bit Server VM 21.9 (build 17.0.2+8-LTS, mixed mode, sharing)

 

cat /etc/centos-release
CentOS Stream release 8

• Assignee: Kevin Risden
• Reporter: John Thorhauer
• Created: 20/Apr/22 18:31
• Updated: 26/Oct/22 14:31
• Resolved: 26/Oct/22 14:31

Description

We are running Solr in a FIPS enabled linux environment.  After upgrading Java to 17.0.2 we now receive the following error while starting Solr:

 

2022-04-20 11:40:03.700 ERROR (main) [   ] o.a.s.c.SolrCore null => org.apache.solr.common.SolrException: Error instantiating shardHandlerFactory class [HttpShardHandlerFactory]: java.lang.IllegalStateException: /opt/solr-8.11.1/server/NONE is not a valid keystore
        at org.apache.solr.handler.component.ShardHandlerFactory.newInstance(ShardHandlerFactory.java:56)

.....

Caused by: java.lang.RuntimeException: java.lang.IllegalStateException: /opt/solr-8.11.1/server/NONE is not a valid keystore
        at org.apache.solr.client.solrj.impl.Http2SolrClient.createHttpClient(Http2SolrClient.java:234) ~[solr-solrj-8.11.1.jar:8.11.1 0b002b11819df70783e83ef36b42ed1223c14b50 - janhoy - 2021-12-14 13:50:57] 

 

We noticed that adding the following allows the server to start properly:

SOLR_OPTS="$SOLR_OPTS -Dcom.redhat.fips=false"

 

However, adding the following does NOT have any effect:

SOLR_OPTS="$SOLR_OPTS -Dcom.redhat.fips.plainKeySupport=true"