Cloudera Docs

Overriding the default excluded cipher suites

Know how to override the default excluded ciper suites for Solr.

By default, Solr excludes cipher suites that use weak algorithms, legacy SSL protocols, anonymous authentication, and TLS_RSA key exchange. The default excluded cipher pattern is:

.*(MD5|SHA1)$,^TLS_RSA.*$,^SSL_.$,.*NULL.*$,.*anon.*$,.*CCM(_8)?$

You can configure excluded cipher suites with the SOLR_SSL_CIPHERS_EXCLUDE environment variable, which maps to the solr.jetty.ssl.ciphers.exclude Java option.

If a client, load balancer, or integration requires TLS_RSA cipher suites, you can override the default exclude list. Customize the regular expression to match your security requirements.

To override the default excluded cipher suites for Solr server roles:

  1. In Cloudera Manager, open the Solr service and click the Configuration tab.
  2. Select Scope > Solr Server (or Scope > All).
  3. Search for Solr Server Environment Advanced Configuration Snippet (Safety Valve).
  4. Add a line to set SOLR_SSL_CIPHERS_EXCLUDE. For example, to allow TLS_RSA cipher suites while still excluding weak ciphers: 
    SOLR_SSL_CIPHERS_EXCLUDE=^.*(MD5|RC4|DES|NULL).$
    You can also set the Java option directly: 
    -Dsolr.jetty.ssl.ciphers.exclude=^.*(MD5|RC4|DES|NULL).$
  5. Enter a Reason for Change, save, and restart the Solr service through the Stale Configuration wizard.