Skip to main content
tims4831424
tims4831424
Inspiring
April 13, 2021
Answered

cfhttp and letsencrypt ssl

  • April 13, 2021
  • 2 replies
  • 1424 views

Hi all,

i have a problem.

If i try cfhttp with google

 

https://www.google.de

 

All is fine.

If i try it with my own site with ssl by letsencrypt, it shows 

Connection Failure

 

What shall i do?

Why dont accept the letsencrypt cert?

I have Coldfusion 2016 and Ubuntu 16 / Apache

 

Kindly Regards

Thorsten

 

 

    This topic has been closed for replies.
    Correct answer BKBK

    @tims4831424 :

        If i try cfhttp with google  https://www.google.de

        All is fine.

     

    That is because Google continues to enable the older TLS 1.0 and TLS 1.1. Which is, generally speaking, not optimal.

     

    The general recommendation now is to support TLS 1.2 or TLS 1.3. Your Java version,  1.8.0_72, is too old for these security protocols. For example, support for TLS 1.3 was introduced in Java 1.8.0_261.

     

    Therefore, as Pete and Charlie suggest, you should upgrade the Java that ColdFusion 2016 uses. Before that, make sure you upgrade ColdFusion 2016 to the latest update level (currently Update 17).

    2 replies

    BKBK
    BKBKCorrect answer
    Community Expert
    April 16, 2021

    @tims4831424 :

        If i try cfhttp with google  https://www.google.de

        All is fine.

     

    That is because Google continues to enable the older TLS 1.0 and TLS 1.1. Which is, generally speaking, not optimal.

     

    The general recommendation now is to support TLS 1.2 or TLS 1.3. Your Java version,  1.8.0_72, is too old for these security protocols. For example, support for TLS 1.3 was introduced in Java 1.8.0_261.

     

    Therefore, as Pete and Charlie suggest, you should upgrade the Java that ColdFusion 2016 uses. Before that, make sure you upgrade ColdFusion 2016 to the latest update level (currently Update 17).

      pete_freitag
      pete_freitag
      Participating Frequently
      April 13, 2021

      Hi Thorsten,

       

      I can confirm that cfhttp to a site using Let's Encrypt for https does infact work with CF2016, but there are a few things I can think of that might be causing the problem. I think I have summarized them all here in this blog entry: https://www.petefreitag.com/item/852.cfm 

       

      The TLDR is:

      1) Version of Java you are using might be too old

      2) Your server might be missing the intermediate cert in its config, use https://whatsmychaincert.com/ to test it.

       

      Hope that helps

      Pete Freitag

      Foundeo Inc.

      tims4831424
      tims4831424Author
      Inspiring
      April 14, 2021

      Hi Pete,

      the cert of Letsencypt is correct  fullchain and privkey..

       

      and this is my coldfusion and java version

      Attache the Screenshot from the Server with Version numbers

       

      And for Example this site:

      https://www.druckhaus-w2p.de

       

      Kindly Regards

      Thorsten

      pete_freitag
      pete_freitag
      Participating Frequently
      April 14, 2021

      The version of java that you are using is 1.8.0_72, which is very old. My guess is that the cacerts file included in that version of java doesn't have Let's Encrypt listed as a trusted certificate authority. The easiest way to fix that is to simply update the JVM, you can grab the latest version of Java 1.8 from Adobe here: https://www.adobe.com/support/coldfusion/downloads.html 

       

      Here's some info on updating the JVM in ColdFusion including a video howto: https://www.petefreitag.com/item/860.cfm

       

       

        Terms & ConditionsAccessibility statement
        Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices