cfhttp and letsencrypt ssl

[tims4831424]

Hi all,

i have a problem.

If i try cfhttp with google

https://www.google.de

All is fine.

If i try it with my own site with ssl by letsencrypt, it shows 

Connection Failure

What shall i do?

Why dont accept the letsencrypt cert?

I have Coldfusion 2016 and Ubuntu 16 / Apache

Kindly Regards

Thorsten

[pete_freitag]

Hi Thorsten,

I can confirm that cfhttp to a site using Let's Encrypt for https does infact work with CF2016, but there are a few things I can think of that might be causing the problem. I think I have summarized them all here in this blog entry: https://www.petefreitag.com/item/852.cfm 

The TLDR is:

1) Version of Java you are using might be too old

2) Your server might be missing the intermediate cert in its config, use https://whatsmychaincert.com/ to test it.

Hope that helps

Pete Freitag

Foundeo Inc.

[tims4831424]

Hi Pete,

the cert of Letsencypt is correct  fullchain and privkey..

and this is my coldfusion and java version

Attache the Screenshot from the Server with Version numbers

And for Example this site:

https://www.druckhaus-w2p.de

Kindly Regards

Thorsten

[pete_freitag · Accepted solution]

The version of java that you are using is 1.8.0_72, which is very old. My guess is that the cacerts file included in that version of java doesn't have Let's Encrypt listed as a trusted certificate authority. The easiest way to fix that is to simply update the JVM, you can grab the latest version of Java 1.8 from Adobe here: https://www.adobe.com/support/coldfusion/downloads.html 

Here's some info on updating the JVM in ColdFusion including a video howto: https://www.petefreitag.com/item/860.cfm

[Charlie Arehart · Accepted solution]

Thanks as always for your insights, Pete. And if it may interest some readers, I have a post with even more detail (than Pete's there) on the matter of how it's so important to upate the JVM that CF uses, to fix most problems of CF calling out via https, whether with cfhttp or other things. That post is here, Solving problems calling out of CF via https, by updating JVM.

[BKBK · Accepted solution]

@tims4831424 :

    If i try cfhttp with google  https://www.google.de

    All is fine.

That is because Google continues to enable the older TLS 1.0 and TLS 1.1. Which is, generally speaking, not optimal.

The general recommendation now is to support TLS 1.2 or TLS 1.3. Your Java version,  1.8.0_72, is too old for these security protocols. For example, support for TLS 1.3 was introduced in Java 1.8.0_261.

Therefore, as Pete and Charlie suggest, you should upgrade the Java that ColdFusion 2016 uses. Before that, make sure you upgrade ColdFusion 2016 to the latest update level (currently Update 17).