CF 2021 - HmacPBESHA256 Not Available - JDK Update

[calm_Eagle3816]

I was notified by Cybersource, that they are upgrading and I am required to use the P12 certificate for Authentication with my SOAP API application that has been running for years with Cybersource.

I'm using the CFHTTP and added the additional variables to include the P12 cert for Authentication, but I'm receiving an error that HmacPBESHA256 is Not Available.

After some research, apperantly CF2021 and its Java JDK Version is 11.0.11 and does not support this agorithum. So, I tried to update the JDK version to 11.0.24, which is listed on Adobes website as being compatabile with CF21. I also updated the jvm.config file to point to the new Home directory for 11.0.24.

Now, the CF Application service will not start.

I'm hoping someone can provide me some much appreciated help.

Thank you!

Michael

[kglad]

is this related to an adobe app or service?

[calm_Eagle3816]

The Coldfusion application service did not start

[BKBK]

The Coldfusion application service did not start

By @calm_Eagle3816

That means there is likely an error in the settings in jvm.config. Take a good look at the contents of the file. 

Could you share the contents with the forum?

[calm_Eagle3816]

posted below is the current working version of the jvm.config file. At the time of the JDK upgrade, I commented out the follow line: Java.home=C:\\ColdFusion2021\\jre and replaced it with the path to the new JDK version: Java.home=C:\\Programfiles\\java\jdk-11   (it was something like that)

------ current running version below ----------------

#
# VM configuration
#
# Where to find JVM, if {java.home}/jre exists then that JVM is used
# if not then it must be the path to the JRE itself

java.home=C:\\ColdFusion2021\\jre

#
# If no java.home is specified a VM is located by looking in these places in this
# order:
#
# 1) ../runtime/jre
# 2) registry (windows only)
# 3) JAVA_HOME env var plus jre (ie $JAVA_HOME/jre)
# 4) java.exe in path
#

# Arguments to VM

java.args=-server -Xms256m -Xmx1024m --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/sun.util.cldr=ALL-UNNAMED --add-opens=java.base/sun.util.locale.provider=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED -XX:+UseParallelGC -Djdk.attach.allowAttachSelf=true -Dcoldfusion.home={application.home} -Duser.language=en -Dcoldfusion.rootDir={application.home} -Dcoldfusion.libPath={application.home}/lib -Dorg.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER=true -Dcoldfusion.jsafe.defaultalgo=FIPS186Random -Dorg.eclipse.jetty.util.log.class=org.eclipse.jetty.util.log.JavaUtilLog -Djava.util.logging.config.file={application.home}/lib/logging.properties -Dtika.config=tika-config.xml -Djava.locale.providers=COMPAT,SPI -Dsun.font.layoutengine=icu -Dcom.sun.media.jai.disableMediaLib=true -Dcoldfusion.searchimplicitscopes=true -Dcoldfusion.classPath=D:\\inetpub\\domains\\ccorp\\www\\randstad\\TEAV,C:\\Efflare\\ImageCR3Service,D:\\inetpub\\domains\\ccorp\\www\\admin\\TEAV,D:\\inetpub\\domains\\ccorp\\www\\admin\\randstad,D:\\inetpub\\domains\\ccorp\\www\\randstad,D:\\inetpub\\domains\\aflac\\www\\TEAV,{application.home}/lib/updates,{application.home}/lib/,{application.home}/gateway/lib/,{application.home}/wwwroot/WEB-INF/cfform/jars,{application.home}/bin/cf-osgicli.jar,"C:\\Program Files\\Common Files\\BCL Technologies\\easyPDF 8\\easypdf.jar"

# Comma separated list of shared library path
java.library.path={application.home}/lib,{application.home}/jintegra/bin,{application.home}/jintegra/bin/international

# Comma separated list of shared library path for non-windows
java.nixlibrary.path={application.home}/lib

java.class.path=

[BKBK]

Try

java.home=C:\\Program Files\\Java\\jdk-11

[BKBK]

Is it now possible to start ColdFusion?

[calm_Eagle3816]

Coldfusion is running, but we rolled back the server to the latest snap that was taken before the changes.

That brings up another point. After CF services did not start, I went back and uninstalled that JDK version and restored the jvm.config file and the services still did not start back. We had to roll back the the latest snap, prior to the update.

[BKBK]

The logs might tell you why ColdFusion didn't start. So, what do the logs say? 

[calm_Eagle3816]

I tried going through the log files, and I cannot seem to find anything to help me. Once we rolled back our snap of the server, we were back up. So, it was related to installing that Java JDK 11.0.24. According to Adobe, https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#downloads3, it looks like that version should work with CF21

[BKBK]

I have given you a suggestion about that. A mistake probably occurred in jvm.config when you modified it. The most likely culprit is the setting java.home.

[calm_Eagle3816]

This evening, I will get a new snap, and try to update again. I think, I'm going to update to 11.0.12, since this version has support for the HmacPBESHA256 algorithum, and not try to go to 11.0.24. Not sure if that will matter, but I thought I would give that a try. I also saw another article that recommended adding the following to that jvm file: Djdk.lang.Process.allowAmbiguousCommands=true

[BKBK]

I don't think that Djdk.lang.Process.allowAmbiguousCommands had anything to do with ColdFusion not starting.

I repeat my suggestion: your jvm.config setting

 Java.home=C:\\Programfiles\\java\jdk-11  

is likely incorrect.

Try instead:

java.home=C:\\Program Files\\Java\\jdk-11

Please let us know whether that resolves the issue of ColdFusion starting. That is important information to share with us, fellow developers.

[calm_Eagle3816]

I'm sorry, that was a typeo. I did have:  java.home=C:\\Program Files\\Java\\jdk-11

I will be trying again this evening, but with 11.0.12

I will post the results

Thank you!

[BKBK]

OK. 

I can confirm that I have tested your other jvm.config settings, and they work without any problems.

[calm_Eagle3816]

What version java jdk did you install?

Thank you

[BKBK]

What version java jdk did you install?

By @calm_Eagle3816

 Java SE 11.0.25 (LTS)

[calm_Eagle3816]

Ok, after searching and searching the internet, I finally was able to download JDK 11.0.12 zip file. I was able to upgrade the CF 2021 from 11.0.11 to 11.0.12 and everything worked. Now, I will get back to my original challenge, which is to update my current Cybersource SOAP API from key to P12 certificate, due to Cybersource changing the Authentication process in Feb 2025.

[BKBK]

The original problem shows the importance of doing updates in time - and across the board, too.

So I would do the following:

1.  Update ColdFusion 2021 to the latest update level, which is Update 17.
2.  Update the Java on which ColdFusion 2021 runs to the latest official version, Java SE 11.0.25 (LTS).
3.  Include the required security certificates.

[calm_Eagle3816]

Thank you. Yes, we have the update 17. However, it was still loading 11.0.11. When I tried to install Java JDK 11.0.24, is when everything went wrong. I finally installed 11.0.12, but not using the .exe file, but by just unzipping it and changing the jvm file to point to the new folder where 11.0.12 was. Looking back, I probably should have done this with 11.0.24 and not ran the .exe installation, but just unzipped the file and updated the jvm file to point to it.

Thank you'll for your feedback. I did get past the original algorithum problem, but now I'm onto the new cybersource P12 requirement for SOAP API, which is another problem for me...

[BKBK]

Hi @calm_Eagle3816 , thanks for the update.