Skip to content

Solr keystore property renames #3840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Solr keystore property renames #3840

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
5a11d4b
Solr keystore property renames
epugh Nov 6, 2025
3c276d2
use standard property name for boolean system properties
epugh Nov 6, 2025
27a1933
Fix casing. However, I don't like this name because of the HTTPS val…
epugh Nov 6, 2025
a12f34e
Does this get us a script run?
epugh Nov 6, 2025
7ea08d2
checking in code, but I moved too quick, and going to need to try again
epugh Nov 6, 2025
ffc93e4
Merge remote-tracking branch 'upstream/main' into SOLR-17864_part_quince
epugh Nov 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion solr/bin/solr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,7 +241,7 @@ if [ "$SOLR_SSL_ENABLED" == "true" ]; then
fi

if [ "${SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION:true}" == "true" ] ; then
SOLR_SSL_OPTS+=" -Dsolr.jetty.ssl.verifyClientHostName=HTTPS"
SOLR_SSL_OPTS+=" -Dsolr.jetty.ssl.verify.client.hostname=HTTPS"
fi

if [ -n "$SOLR_SSL_NEED_CLIENT_AUTH" ]; then
Expand Down
4 changes: 2 additions & 2 deletions solr/bin/solr.cmd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ IF "%SOLR_SSL_ENABLED%"=="true" (
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.keystore=%SOLR_SSL_KEY_STORE%"
IF "%SOLR_SSL_RELOAD_ENABLED%"=="true" (
IF "%SOLR_SECURITY_MANAGER_ENABLED%"=="true" (
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.keystoreParentPath=%SOLR_SSL_KEY_STORE%/.."
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.keystore.parent.path=%SOLR_SSL_KEY_STORE%/.."
)
)
)
Expand All @@ -129,7 +129,7 @@ IF "%SOLR_SSL_ENABLED%"=="true" (
set SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION=true
)
IF "%SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION%"=="true" (
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.ssl.verifyClientHostName=HTTPS"
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.ssl.verify.client.hostname=HTTPS"
)

IF DEFINED SOLR_SSL_NEED_CLIENT_AUTH (
Expand Down
6 changes: 3 additions & 3 deletions solr/core/src/test/org/apache/solr/cloud/TestMiniSolrCloudClusterSSL.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ public class TestMiniSolrCloudClusterSSL extends SolrTestCaseJ4 {

@Rule
public TestRule syspropRestore =
new TestRuleRestoreSystemProperties(SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME);
new TestRuleRestoreSystemProperties(SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME_ENABLED);

@Before
public void before() {
Expand Down Expand Up @@ -178,7 +178,7 @@ private void checkClusterWithNodeReplacement(SSLTestConfig sslConfig) throws Exc
SSLContext.setDefault(
sslConfig.isSSLMode() ? sslConfig.buildClientSSLContext() : DEFAULT_SSL_CONTEXT);
System.setProperty(
SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME,
SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME_ENABLED,
Boolean.toString(sslConfig.getCheckPeerName()));
HttpClientUtil.resetHttpClientBuilder();
Http2SolrClient.resetSslContextFactory();
Expand Down Expand Up @@ -208,7 +208,7 @@ public void testSslWithInvalidPeerName() throws Exception {

// now initialize a client that still uses the existing SSLContext/Provider, so it will accept
// our existing certificate, but *does* care about validating the peer name
System.setProperty(SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME, "true");
System.setProperty(SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME_ENABLED, "true");
HttpClientUtil.resetHttpClientBuilder();
Http2SolrClient.resetSslContextFactory();

Expand Down
6 changes: 3 additions & 3 deletions solr/server/etc/jetty-http.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,9 @@
</Arg>
<Set name="host"><Property name="solr.host.bind" default="127.0.0.1"/></Set>
<Set name="port"><Property name="solr.port.listen" default="8983" /></Set>
<Set name="idleTimeout"><Property name="solr.jetty.http.idleTimeout" default="120000"/></Set>
<Set name="acceptorPriorityDelta"><Property name="solr.jetty.http.acceptorPriorityDelta" default="0"/></Set>
<Set name="acceptQueueSize"><Property name="solr.jetty.http.acceptQueueSize" default="0"/></Set>
<Set name="idleTimeout"><Property name="solr.jetty.http.timeout.ms" default="120000"/></Set>
Copy link
Member

@tflobbe tflobbe Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure I like removing the "idle", it makes the parameter confusing, as the user wouldn't know what kind of timeout this is (my first thought would be this is a request timeout)

<Set name="acceptorPriorityDelta"><Property name="solr.jetty.http.acceptor.priority.delta" default="0"/></Set>
<Set name="acceptQueueSize"><Property name="solr.jetty.http.accept.queue.size" default="0"/></Set>
<Set name="reuseAddress"><Property name="solr.jetty.http.reuseAddress" default="true"/></Set>
<Set name="reusePort"><Property name="solr.jetty.http.reusePort" default="false"/></Set>
<Set name="acceptedTcpNoDelay"><Property name="solr.jetty.http.acceptedTcpNoDelay" default="true"/></Set>
Expand Down
4 changes: 2 additions & 2 deletions solr/server/etc/jetty-https.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,8 +66,8 @@
<Set name="host"><Property name="solr.host.bind" default="127.0.0.1"/></Set>
<Set name="port"><Property name="solr.jetty.https.port" default="8983" /></Set>
<Set name="idleTimeout"><Property name="solr.jetty.https.timeout" default="120000"/></Set>
Copy link
Member

@tflobbe tflobbe Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this timeout property is different than the new one you are adding, for the same thing

<Set name="acceptorPriorityDelta"><Property name="solr.jetty.ssl.acceptorPriorityDelta" default="0"/></Set>
<Set name="acceptQueueSize"><Property name="solr.jetty.https.acceptQueueSize" default="0"/></Set>
<Set name="acceptorPriorityDelta"><Property name="solr.jetty.ssl.acceptor.priority.delta" default="0"/></Set>
<Set name="acceptQueueSize"><Property name="solr.jetty.https.accept.queue.size" default="0"/></Set>
<Set name="reuseAddress"><Property name="solr.jetty.ssl.reuseAddress" default="true"/></Set>
<Set name="reusePort"><Property name="solr.jetty.ssl.reusePort" default="false"/></Set>
<Set name="acceptedTcpNoDelay"><Property name="solr.jetty.ssl.acceptedTcpNoDelay" default="true"/></Set>
Expand Down
2 changes: 1 addition & 1 deletion solr/server/etc/jetty-ssl.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
<Set name="WantClientAuth"><Property name="solr.jetty.ssl.want.client.auth.enabled" default="false"/></Set>
<Set name="KeyStoreType"><Property name="solr.jetty.keystore.type" default="PKCS12"/></Set>
<Set name="TrustStoreType"><Property name="solr.jetty.truststore.type" default="PKCS12"/></Set>
<Set name="EndpointIdentificationAlgorithm"><Property name="solr.jetty.ssl.verifyClientHostName"/></Set>
<Set name="EndpointIdentificationAlgorithm"><Property name="solr.jetty.ssl.verify.client.hostname"/></Set>
<Set name="useCipherSuitesOrder" property="solr.jetty.ssl.useCipherSuitesOrder" />
<Set name="sslSessionCacheSize" property="solr.jetty.ssl.sslSessionCacheSize" />
<Set name="sslSessionTimeout" property="solr.jetty.ssl.sslSessionTimeout" />
Expand Down
2 changes: 1 addition & 1 deletion solr/server/etc/jetty.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@
<Set name="sendServerVersion"><Property name="solr.jetty.send.server.version" default="false" /></Set>
<Set name="sendDateHeader"><Property name="solr.jetty.send.date.header" default="false" /></Set>
<Set name="headerCacheSize"><Property name="solr.jetty.header.cache.size" default="512" /></Set>
<Set name="delayDispatchUntilContent"><Property name="solr.jetty.delayDispatchUntilContent" default="false"/></Set>
<Set name="delayDispatchUntilContent"><Property name="solr.jetty.delay.dispatch.until.content" default="false"/></Set>
<Set name="relativeRedirectAllowed">true</Set><!-- can remove in Jetty 12, which has this default -->
<!-- Uncomment to enable handling of X-Forwarded- style headers
<Call name="addCustomizer">
Expand Down
2 changes: 1 addition & 1 deletion solr/server/etc/security.policy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ grant {

permission java.io.FilePermission "${javax.net.ssl.trustStore}", "read,readlink";

permission java.io.FilePermission "${solr.jetty.keystoreParentPath}", "read,readlink";
permission java.io.FilePermission "${solr.jetty.keystore.parent.path}", "read,readlink";
permission java.io.FilePermission "${javax.net.ssl.keyStoreParentPath}", "read,readlink";

permission java.io.FilePermission "${solr.install.dir}", "read,write,delete,readlink";
Expand Down
2 changes: 2 additions & 0 deletions solr/solr-ref-guide/modules/upgrade-notes/pages/major-changes-in-solr-10.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ The previous `SOLR_HOST` and 'host' are deprecated and now use `SOLR_HOST_ADVERT

The previous `jetty.port` is deprecated and now use `solr.port.listen`.

Many of the properties in the various `solr/server/etc/jetty-*.xml` files have been updated to be dot seperated names.


=== Solr CLI and Scripts

Expand Down
2 changes: 1 addition & 1 deletion solr/solrj/src/java/org/apache/solr/client/solrj/impl/Http2SolrClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1109,7 +1109,7 @@ public static void resetSslContextFactory() {

/* package-private for testing */
static SslContextFactory.Client getDefaultSslContextFactory() {
String checkPeerNameStr = System.getProperty(SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME);
String checkPeerNameStr = System.getProperty(SolrHttpConstants.SYS_PROP_CHECK_PEER_NAME_ENABLED);
boolean sslCheckPeerName = !"false".equalsIgnoreCase(checkPeerNameStr);

SslContextFactory.Client sslContextFactory = new SslContextFactory.Client(!sslCheckPeerName);
Expand Down
2 changes: 1 addition & 1 deletion solr/solrj/src/java/org/apache/solr/client/solrj/impl/SolrHttpConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ public interface SolrHttpConstants {
* System property consulted to determine if HTTP based SolrClients will require hostname
* validation of SSL Certificates. The default behavior is to enforce peer name validation.
*/
String SYS_PROP_CHECK_PEER_NAME = "solr.ssl.check.peer.name.enabled";
String SYS_PROP_CHECK_PEER_NAME_ENABLED = "solr.ssl.check.peer.name.enabled";

/** Basic auth username */
String PROP_BASIC_AUTH_USER = "httpBasicAuthUser";
Expand Down
8 changes: 4 additions & 4 deletions solr/test-framework/src/java/org/apache/solr/client/solrj/apache/HttpClientUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,7 @@ public static void setHttpClientProvider(SolrHttpClientBuilder newHttpClientBuil
}

/**
* @see #SYS_PROP_CHECK_PEER_NAME
* @see #SYS_PROP_CHECK_PEER_NAME_ENABLED
*/
public static void setSocketFactoryRegistryProvider(
SocketFactoryRegistryProvider newRegistryProvider) {
Expand All @@ -259,7 +259,7 @@ public static SolrHttpClientBuilder getHttpClientBuilder() {
}

/**
* @see #SYS_PROP_CHECK_PEER_NAME
* @see #SYS_PROP_CHECK_PEER_NAME_ENABLED
*/
public static SocketFactoryRegistryProvider getSocketFactoryRegistryProvider() {
return socketFactoryRegistryProvider;
Expand All @@ -286,15 +286,15 @@ public Registry<ConnectionSocketFactory> getSocketFactoryRegistry() {
SSLConnectionSocketFactory sslConnectionSocketFactory = null;
boolean sslCheckPeerName =
toBooleanDefaultIfNull(
toBooleanObject(System.getProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME)), true);
toBooleanObject(System.getProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME_ENABLED)), true);
if (sslCheckPeerName) {
sslConnectionSocketFactory = SSLConnectionSocketFactory.getSystemSocketFactory();
} else {
sslConnectionSocketFactory =
new SSLConnectionSocketFactory(
SSLContexts.createSystemDefault(), NoopHostnameVerifier.INSTANCE);
log.debug(
"{} is false, hostname checks disabled.", HttpClientUtil.SYS_PROP_CHECK_PEER_NAME);
"{} is false, hostname checks disabled.", HttpClientUtil.SYS_PROP_CHECK_PEER_NAME_ENABLED);
}
builder.register("https", sslConnectionSocketFactory);

Expand Down
2 changes: 1 addition & 1 deletion solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ public SSLTestConfig(boolean useSsl, boolean clientAuth) {
* @param clientAuth - whether client authentication should be required.
* @param checkPeerName - whether the client should validate the 'peer name' of the SSL
* Certificate (and which testing Cert should be used)
* @see SolrHttpConstants#SYS_PROP_CHECK_PEER_NAME
* @see SolrHttpConstants#SYS_PROP_CHECK_PEER_NAME_ENABLED
*/
@SuppressWarnings("removal")
public SSLTestConfig(boolean useSsl, boolean clientAuth, boolean checkPeerName) {
Expand Down
8 changes: 4 additions & 4 deletions solr/test-framework/src/test/org/apache/solr/client/solrj/apache/HttpClientUtilTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ public class HttpClientUtilTest extends SolrTestCase {

@Rule
public TestRule syspropRestore =
new TestRuleRestoreSystemProperties(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME);
new TestRuleRestoreSystemProperties(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME_ENABLED);

@After
public void resetHttpClientBuilder() {
Expand All @@ -64,17 +64,17 @@ public void testSSLSystemProperties() {
assertSSLHostnameVerifier(
DefaultHostnameVerifier.class, HttpClientUtil.getSocketFactoryRegistryProvider());

System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME, "true");
System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME_ENABLED, "true");
resetHttpClientBuilder();
assertSSLHostnameVerifier(
DefaultHostnameVerifier.class, HttpClientUtil.getSocketFactoryRegistryProvider());

System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME, "");
System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME_ENABLED, "");
resetHttpClientBuilder();
assertSSLHostnameVerifier(
DefaultHostnameVerifier.class, HttpClientUtil.getSocketFactoryRegistryProvider());

System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME, "false");
System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME_ENABLED, "false");
resetHttpClientBuilder();
assertSSLHostnameVerifier(
NoopHostnameVerifier.class, HttpClientUtil.getSocketFactoryRegistryProvider());
Expand Down
Loading