Accept all SSL certificates (bypass truststore)

Forum|Forum|7 years ago
August 22, 2018
3 replies
2514 views

Hi,

Is it possible to allow all HTTPS calls from ColdFusion/Java to be accepted and not check against the truststore? Looking to not have to reboot CF each time a new SSL needs applying onto a server.

Cheers,

This topic has been closed for replies.

Correct answer JonOnTheWeb

Assuming as fixed as nothing that can be done apart from use Lucee instead.

James Moberg

Inspiring

We once consumed a third-party API that would occasionally change IPs because it was "in the cloud" and they couldn't control their IP. (I believe SparkPost's SMTP gateway is like this too.) To avoid "forever DNS" issues and accept invalid/unknown SSL certificates, we used CFX_HTTP5 and enabled the SSLERRORS="OK" flag. It allowed us to ignore certificate errors as well as automatically use any of the Windows SSL certificates without ever having to manually install and restart ColdFusion. (CFX_HTTP5 also honors DNS TTL which I believe that isn't correctly honored by java.... it's either "never" or "forever", right?) Another feature that benefited us was the ability to specify the specific TLS version we wanted so we could force TLS1.2 and not fall back to something less secure.

J

JonOnTheWebAuthorCorrect answer

Inspiring

Assuming as fixed as nothing that can be done apart from use Lucee instead.

WolfShade

Brainiac

The truststore is there for a reason. Bypassing it, you get what you deserve.

V/r,

^ _ ^

J

JonOnTheWebAuthor

Inspiring

Then Adobe needs to build a better system for managing them as the current system is pretty poor. Valid SSLs should only be allowed to be called but with ever changing SSL providers and updated SSLs CF/Java doesn't seem to keep up.

D

Dave Watts

Adobe Expert

This isn't really an Adobe problem, it's a problem with how certificate trust works and how Java works. The certificate trust system is kind of broken, really, and Java application servers don't let you dynamically load certificates into the keystore. Because ColdFusion runs on a Java application server, they're kind of held hostage by what that server does. So, it's complicated, and it's unrealistic to expect Adobe to fix that. The real fix for these sorts of general issues is to have a pool of servers rather than one individual server, so that you can make changes to a server (or an underlying container running said server like Docker etc) then you replace the running servers in the pool.

Dave Watts, Fig Leaf Software

Dave Watts, Eidolon LLC

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded