Solr 8.11 SSL Setup

Shivam J Panchal

4 min read

·

Oct 28, 2026

--

Listen

Share

A practical Windows setup guide for Apache Solr 8.11.4 with Java 11, a self-signed certificate, SSL configuration and startup validation.

Updated Aug 2026 · ~10 min read · 6 phases · By Shivam Panchal

Estimated Time: 20–30 min
Difficulty: Intermediate
Solr Version: 8.11.4
Java Version: JDK 11

Overview

This runbook configures Apache Solr 8.11.4 on Windows with Java 11 and HTTPS. It includes installing the required software, setting JAVA_HOME, creating a PFX certificate, configuring Solr’s keystore and truststore values, and confirming that Solr starts successfully.

Use the same certificate password and file name consistently throughout the setup. The configuration examples below use sitecore-cert.pfx and admin@123; replace them if you choose different values.

Security note: the password shown here is an example. Use a strong unique password for any shared, UAT, or production environment.

Phase 1: Prerequisites

Purpose: install the exact runtime versions Solr 8.11 requires before configuring SSL.

• Download and extract Apache Solr 8.11.4.
• Download and install Java JDK 11 — for example, JDK 11.0.31.
• Place Solr in a stable local folder, such as C:\solr\solr-8.11.4.
• Run PowerShell or Command Prompt as Administrator when creating and importing the certificate.

This guide assumes the Solr installation path is C:\solr\solr-8.11.4. Update the paths below if your installation is elsewhere.

Phase 2: Configure JAVA_HOME

Under User variables, create or update JAVA_HOME. Point it to the JDK folder itself — not its bin folder.

• Example value: C:\Program Files\Java\jdk-11.0.31
• Open a new Command Prompt after changing the environment variable.
• Confirm both Java and the variable resolve correctly.

Command Prompt — verify Java

java -version
echo %JAVA_HOME%

✓ Expected result: java -version reports Java 11 and echo %JAVA_HOME% prints the JDK folder without \bin.

Phase 3: Create the SSL Certificate

Create the certificate in the Solr configuration directory: C:\solr\solr-8.11.4\server\etc. Run the following in PowerShell as Administrator after changing to that folder.

PowerShell — create and export certificate

$certName = "sitecorecert"
$password = ConvertTo-SecureString -String "YourStrongPassword!" -Force -AsPlainText

$cert = New-SelfSignedCertificate -DnsName "sitecorecert.local", "localhost" `
    -CertStoreLocation "Cert:\LocalMachine\My" `
    -FriendlyName $certName `
    -NotAfter (Get-Date).AddYears(2) `
    -KeyExportPolicy Exportable `
    -KeySpec Signature `
    -KeyLength 2048
$certPath = Join-Path (Get-Location) "$certName.pfx"
Export-PfxCertificate -Cert $cert -FilePath $certPath -Password $password
Write-Host "Certificate exported: $certPath" -ForegroundColor CyanConfirm certificate creation

• Open certlm.msc → Personal → Certificates.
• Confirm sitecorecert appears and has a two-year expiry.
• Confirm the PFX was exported inside server\etc.

Phase 4: Trust the Certificate

Import the newly created certificate into the trusted certificate store. This lets Windows and the local services trust the self-signed certificate.

• Open certlm.msc.
• Locate the certificate under Personal → Certificates.
• Copy or import it into the appropriate Trusted Root Certification Authorities → Certificates store.
• Keep the PFX file in C:\solr\solr-8.11.4\server\etc.

Use the same PFX file everywhere. If the file name, password, or path differs from the Solr settings, Solr will not start with SSL enabled.

Phase 5: Configure Solr SSL

Open C:\solr\solr-8.11.4\bin\solr.in.cmd in a text editor and add or update the values below. Ensure the certificate file name and password match the PFX you created.

solr.in.cmd — SSL settings

set SOLR_SSL_ENABLED=true

set SOLR_SSL_KEY_STORE=C:\solr\solr-8.11.4\server\etc\sitecore-cert.pfx
set SOLR_SSL_KEY_STORE_TYPE=PKCS12
set SOLR_SSL_KEY_STORE_PASSWORD=admin@123

set SOLR_SSL_TRUST_STORE=C:\solr\solr-8.11.4\server\etc\sitecore-cert.pfx
set SOLR_SSL_TRUST_STORE_PASSWORD=admin@123
set SOLR_SSL_TRUST_STORE_TYPE=PKCS12

set SOLR_SSL_CLIENT_KEY_STORE=C:\solr\solr-8.11.4\server\etc\sitecore-cert.pfx
set SOLR_SSL_CLIENT_KEY_STORE_PASSWORD=admin@123
set SOLR_SSL_CLIENT_KEY_STORE_TYPE=PKCS12

set SOLR_SSL_CLIENT_TRUST_STORE=C:\solr\solr-8.11.4\server\etc\sitecore-cert.pfx
set SOLR_SSL_CLIENT_TRUST_STORE_PASSWORD=admin@123
set SOLR_SSL_CLIENT_TRUST_STORE_TYPE=PKCS12

• Confirm the active configuration
• Open Command Prompt as Administrator.
• Run echo %SOLR_SSL_KEY_STORE%.
• It should print the complete path to your certificate file.

Phase 6: Start and Verify Solr

Open Command Prompt as Administrator, change to the Solr bin directory, and start Solr.

Command Prompt — start Solr

cd C:\solr\solr-8.11.4\bin
solr.cmd start

Validate the service

• Open https://localhost:8983/solr in a browser.
• Accept the local certificate warning if prompted for the self-signed certificate.
• Confirm the Solr Admin UI loads and check the Solr status page for the expected version.

✓ Setup complete. Solr is now configured to use SSL with your PKCS12 certificate.

Solr Setup Checklist

• Solr 8.11.4 is downloaded and extracted
• Java 11 is installed
• JAVA_HOME points to the JDK folder
• PFX certificate exists in server\etc
• Certificate is trusted locally
• SSL paths and passwords are set in solr.in.cmd
• Solr Admin UI opens over HTTPS

Troubleshooting

1. java is not recognized
Likely Cause: Java PATH or JAVA_HOME is incorrect.
Fix: Set JAVA_HOME to the JDK root and open a new terminal.

2. Solr will not start with SSL
Likely Cause: PFX path, password, or type does not match.
Fix: Check every SOLR_SSL_* value in solr.in.cmd.

3. Browser displays certificate warning
Likely Cause: The certificate is self-signed.
Fix: Trust the certificate locally or use a CA-signed certificate.

4. Keystore file not found
Likely Cause: Certificate is not in server\etc or filename differs.
Fix: Move/rename the PFX or correct the configured path.

FAQ

Should JAVA_HOME include the bin folder?
No. Set JAVA_HOME to the JDK root folder, for example C:\Program Files\Java\jdk-11.0.31. The bin folder is used through the PATH.

Can I use a different certificate name or password?
Yes. Update every keystore and truststore path and password in solr.in.cmd to match your chosen PFX.

Is a self-signed certificate suitable for production?
Use a certificate issued by a trusted certificate authority for production. A self-signed certificate is appropriate for local development and isolated test environments.