Skip to main content
jdunn_certain
jdunn_certain
Participant
Oct 27, 2017 9:43 PM UTC
Question

cfhttp in CF11 always sends TLSv1 when using client certificate

We have our JVM (1.7) set to use TLS1.2 by default, and cfhttp correctly uses that setting, unless we use the clientcert attribute; when the clientcert attribute is used the ClientHello always sends TLSv1. Has anyone else encountered this behavior?

    This topic is closed to new replies. Start a new post to keep the conversation going.

    2 replies

    BKBK
    Community Expert
    BKBKCommunity Expert
    Community Expert
    Oct 29, 2017 2:15 PM UTC

    This sounds eerily like a TLS issue that was discovered in Lucee. There it turned out that "TLSv1" had been hard-coded in the underlying Java library. So, to be on the safe side, you should report this as a bug. It might help to mention the Lucee link in your report.

    Translate
    jdunn_certain
    jdunn_certainAuthor
    Participant
    Oct 30, 2017 5:54 PM UTC

    Thank you BKBK, I have created issue CF-4200073.

    CF-4200073

    CF-4200073

    Translate
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices