Solr Cert Renewal Issue

["Ritesh Kumar (Avanade)" <v-...@microsoft.com.INVALID>]

Hello All,

I need to renew the expiring cert for SOLR in a Windows SOLR-ZK ensemble with 3 Solr VMs and 3 ZK VMs and as this is critical application I am performing one Solr VM at a time so that my index is available.
So on the non-leader VM, I placed the new PFX cert at "F:\solr-6.6.3\server\etc" & created a JKS file in the same location (overwrote the old at same location after taking the backup).

The new PFX cert has been installed at Personal\Certificates & copied to Trusted Root CA as well as Trusted People.

When I restart the Solr service (restarted VM as well), I can see the new cert in the solr url but do not see the index coming online.

This is the below SOLR error I am receiving:

2020-10-29 22:53:57.212 ERROR (recoveryExecutor-3-thread-3-processing-n:IPAddress:8983_solr x:z_web_index_rebuild_shard1_replica2 s:shard1 c:z_web_index_rebuild r:core_node6) [c:z_web_index_rebuild s:shard1 r:core_node6 x:z_web_index_rebuild_shard1_replica2] o.a.s.c.RecoveryStrategy Error while trying to recover. core=z_web_index_rebuild_shard1_replica2:java.util.concurrent.ExecutionException: org.apache.solr.client.solrj.SolrServerException: IOException occured when talking to server at: https://IPAddress:8983/solr
              at java.util.concurrent.FutureTask.report(Unknown Source)
              at java.util.concurrent.FutureTask.get(Unknown Source)
              at org.apache.solr.cloud.RecoveryStrategy.sendPrepRecoveryCmd(RecoveryStrategy.java:678)
              at org.apache.solr.cloud.RecoveryStrategy.sendPrepRecoveryCmd(RecoveryStrategy.java:653)
              at org.apache.solr.cloud.RecoveryStrategy.doRecovery(RecoveryStrategy.java:413)
              at org.apache.solr.cloud.RecoveryStrategy.run(RecoveryStrategy.java:284)
              at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176)
              at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
              at java.util.concurrent.FutureTask.run(Unknown Source)
              at org.apache.solr.common.util.ExecutorUtil$MDCAwareThreadPoolExecutor.lambda$execute$0(ExecutorUtil.java:229)
              at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
              at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
              at java.lang.Thread.run(Unknown Source)
Caused by: org.apache.solr.client.solrj.SolrServerException: IOException occured when talking to server at: https://IPAddress:8983/solr
              at org.apache.solr.client.solrj.impl.HttpSolrClient.executeMethod(HttpSolrClient.java:626)
              at org.apache.solr.client.solrj.impl.HttpSolrClient.lambda$httpUriRequest$0(HttpSolrClient.java:319)
              ... 5 more
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.ssl.Alerts.getSSLException(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
              at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
              at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
              at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
              at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
              at sun.security.ssl.Handshaker.processLoop(Unknown Source)
              at sun.security.ssl.Handshaker.process_record(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
              at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:535)
              at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:403)
              at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:177)
              at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:304)
              at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:611)
              at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446)
              at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863)
              at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
              at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:57)
              at org.apache.solr.client.solrj.impl.HttpSolrClient.executeMethod(HttpSolrClient.java:515)
              ... 6 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
              at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
              at sun.security.validator.Validator.validate(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
              ... 24 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
              at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
              at java.security.cert.CertPathBuilder.build(Unknown Source)
              ... 30 more

Thanks
Ritesh