TL; DR
Настройка, SSL в SOLR 6 - теперь, когда curl в экземпляре, я получаю следующую ошибку
$ curl -u username:password "https://fake.org:8983/solr/name/select?q=*:*&wt=json&indent=on"
curl: (60) Issuer certificate is invalid.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
Deets
Iпытался настроить SSL на SOLR 6, используя официальную документацию здесь
После запуска SOLR с установленными свойствами SSL я могу подключиться к нему через curl следующим образом, и этодает мне точные результаты.
curl -u username:password "https://localhost:8983/solr/name/select?q=*:*&wt=json&indent=on" -k --verbose
Однако, если я удаляю флаг -k из своей команды curl, я получаю следующую ошибку
$ curl -u username:password "https://fake.org:8983/solr/name/select?q=*:*&wt=json&indent=on" --verbose
* About to connect() to domain port 8983 (#0)
* Trying 127.0.0.1...
* Connected to fake.org (127.0.0.1) port 8983 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Server certificate:
* subject: CN=fake.org,OU=XX,O=XXX,L=XXX,ST=XXX,C=XX
* start date: Oct 03 10:02:10 2019 GMT
* expire date: Feb 17 10:02:10 2047 GMT
* common name: fake.org
* issuer: CN=fake.org,OU=XX,O=XXX,L=XXX,ST=XXX,C=XX
* NSS error -8156 (SEC_ERROR_CA_CERT_INVALID)
* Issuer certificate is invalid.
* Closing connection 0
curl: (60) Issuer certificate is invalid.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
$
Теперь что-то говорит мне, что я должен получить .crt файл, которому доверяет хранилище ключей, но я не уверен, что это за файл crt.