Uploaded image for project: 'Solr'
  1. Solr
  2. SOLR-16964

sniHostCheck should default to SOLR_SSL_CHECK_PEER_NAME

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Closed
    • Major
    • Resolution: Fixed
    • 9.2
    • 9.4
    • Server
    • None

    Description

      When we upgraded Solr to Jetty 10, it started doing SNI checks by default. To combat this, Tomas added an option to skip SNI Host checking in SOLR-16735. I think that this should default to the option already given in SOLR_SSL_CHECK_PEER_NAME, which is practically the same check for clients. (SNI is a server setting).

      So if we start to set solr.jetty.ssl.sniHostCheck by default to the value that SOLR_SSL_CHECK_PEER_NAME has, then users will see no issues when using Solr as they had been. If users want to separate their server/client settings. They can always still provide the solr.jetty.ssl.sniHostCheck option themselves in SOLR_OPTS, which will override the option defaulted by Solr.

      Attachments

        Issue Links

          Activity

            People

              houston Houston Putman
              houston Houston Putman
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 10m
                  10m