Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gen-pkcs12-keystore init container fails if the tls secret contains no ca.crt #684

Open
smoldenhauer-ish opened this issue Feb 9, 2024 · 1 comment · May be fixed by #685
Open

gen-pkcs12-keystore init container fails if the tls secret contains no ca.crt #684

smoldenhauer-ish opened this issue Feb 9, 2024 · 1 comment · May be fixed by #685
Labels
bug Something isn't working security TLS or Auth for Solr
Milestone

Comments

@smoldenhauer-ish
Copy link
Contributor

Configure the solrTLS with a TLS secret that contains only a tls.crt and a tls.key
It seems to be dependent on the issuer if there is a separate ca.crt or not e.g. see cert-manager/cert-manager#1571

    solrTLS:
      keyStorePasswordSecret:
        name: security
        key: password-key
      pkcs12Secret:
        name: solrcloud-tls
        key: keystore.p12

The generated init container command
openssl pkcs12 -export -in /var/solr/tls/tls.crt -in /var/solr/tls/ca.crt -inkey /var/solr/tls/tls.key -out /var/solr/tls/pkcs12/keystore.p12 -passout pass:${SOLR_SSL_KEY_STORE_PASSWORD}
fails with
Can't open /var/solr/tls/ca.crt for reading, No such file or directory 139805662672192:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:69:fopen('/var/solr/tls/ca.crt','r') 139805662672192:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:76:

However if the keystore is generated with the tls.crt and tls.key as input it works. (The tls.crt contains the full chain of certificates)

@smoldenhauer-ish
Copy link
Contributor Author

I will provide a pull request to include the -in ca.crt only if there is a ca.crt file present:

Tested:

    Command:
      sh
      -c
      OPTIONAL_CACRT=$(test -e /var/solr/tls/ca.crt && echo ' -in /var/solr/tls/ca.crt'); openssl pkcs12 -export -in /var/solr/tls/tls.crt $OPTIONAL_CACRT -inkey /var/solr/tls/tls.key -out /var/solr/tls/pkcs12/keystore.p12 -passout pass:${SOLR_SSL_KEY_STORE_PASSWORD}

@HoustonPutman HoustonPutman linked a pull request Mar 26, 2024 that will close this issue
@HoustonPutman HoustonPutman added this to the v0.8.1 milestone Mar 26, 2024
@HoustonPutman HoustonPutman added bug Something isn't working security TLS or Auth for Solr labels Mar 26, 2024
smoldenhauer-ish added a commit to intershop/solr-operator that referenced this issue Apr 4, 2024
…e#684)


* Apply suggestions from code review

Co-authored-by: Houston Putman <houstonputman@gmail.com>
smoldenhauer-ish added a commit to intershop/solr-operator that referenced this issue Apr 4, 2024
…e#684)

 * add e2e test generating keystore with init container
smoldenhauer-ish added a commit to intershop/solr-operator that referenced this issue Apr 5, 2024
…e#684)

 * use -certfile option for ca.crt if present
 * add to changelog
@gerlowskija gerlowskija modified the milestones: v0.8.1, main (v0.9.0) Apr 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working security TLS or Auth for Solr
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants