Douglas:
- You're not adding the cert to cf scheduler. You're adding to the jvm cf points to, because the cf scheduler (and cfhttp) use that to run. If some url requires a special cert, then you need to add it to the jvm cf uses. Just clarifying that technicality
- And yes, normally one would add it to the cacerts of that jvm. But you've attempted to override that with the jvm arg, -Djavax.net.ssl.trustStore
- You say you've been running cf2021 with Java 17 for months. OK. I'm just clarifying that's not supported by Adobe. Cf2021 supported only Java 11. There's no telling what odd things can happen
- You feel that the only change before things went wrong was that you added a new cert. But if your test of a cfhttp to Google was working BEFORE that change, I can't see at all how that simple action would break such a call
- As for what other jvm args I mean, I'm referring to wherever you put that - Djavax.net.ssl.trustStore. Did you add any other non-standard jvm args in that place? Or did you somehow inherit this configuration of things from someone else?
Going back to your original task, yes it should be simple to resolve. I'm sensing that things aren't working because you've done things out of the norm. And I get it: you feel it worked before so should work still. But nothing about cf breaks simply because you add a cert to the keystore. If that's truly ALL that you did, I'd find that surprising. We might more readily find in a session together that there's more to this matter than meets the eye.
But here's one more thing you could pursue on your own if you prefer: look into adding the jvm arg (-Djavax.net.debug=all) which causes the jvm to log debugging info about ssl/tls connection processing (which happens when a cfhttp or scheduled task runs). This can generate a LOT of log info for each attempted connection, so it's easier when you can know your request is the only one, running in a given few seconds.
You can find more details by searching the web or ai for that jvm arg (no need to refer to or seek coldfusion references specifically, as the issue is again not about cf but about that underlying https connection attempt via Java). The logging will create several dozen lines for each connection attempt. Please don't just dump them here and ask for help making sense of them. If anything, winnow them down to a specific line or two in error. Or again all this is something I could help with directly.
Finally, are you working on some production server that's having this issue? If so, have you attempted all the same configuration in a local (or remote) dev environment. (Note that CF is free for development use. You could implement it either in the same OS or another. whether on a real machine or a VM.) Sometimes doing that helps you see more clearly how and when things went from working to not working. I can help do that, which can take just several minutes.
Or perhaps you'll find something based on what's been shared or that someone else may offer here.
/Charlie (troubleshooter, carehart. org)
12
Replies
AdChoices