Accept all SSL certificates (bypass truststore)

[JonOnTheWeb]

Hi,

Is it possible to allow all HTTPS calls from ColdFusion/Java to be accepted and not check against the truststore? Looking to not have to reboot CF each time a new SSL needs applying onto a server.

Cheers,

[WolfShade]

The truststore is there for a reason.  Bypassing it, you get what you deserve.

V/r,

^ _ ^

[JonOnTheWeb]

Then Adobe needs to build a better system for managing them as the current system is pretty poor. Valid SSLs should only be allowed to be called but with ever changing SSL providers and updated SSLs CF/Java doesn't seem to keep up.

[Dave Watts]

This isn't really an Adobe problem, it's a problem with how certificate trust works and how Java works. The certificate trust system is kind of broken, really, and Java application servers don't let you dynamically load certificates into the keystore. Because ColdFusion runs on a Java application server, they're kind of held hostage by what that server does. So, it's complicated, and it's unrealistic to expect Adobe to fix that. The real fix for these sorts of general issues is to have a pool of servers rather than one individual server, so that you can make changes to a server (or an underlying container running said server like Docker etc) then you replace the running servers in the pool.

Dave Watts, Fig Leaf Software

[JonOnTheWeb]

I do understand it is within Java the issue but Adobe could make their end work better - take Lucee for example, much easier system and works straight out of the box from within their admin (Enter URL, confirm port, click install => Done).

EDIT:

Also to say the real fix is to add more servers with CF and have pools etc is very Adobe like - just pay more money and it will be fine.

[JonOnTheWeb · Accepted solution]

Assuming as fixed as nothing that can be done apart from use Lucee instead.

[James Moberg]

We once consumed a third-party API that would occasionally change IPs because it was "in the cloud" and they couldn't control their IP.  (I believe SparkPost's SMTP gateway is like this too.)   To avoid "forever DNS" issues and accept invalid/unknown SSL certificates, we used CFX_HTTP5 and enabled the SSLERRORS="OK" flag.  It allowed us to ignore certificate errors as well as automatically use any of the Windows SSL certificates without ever having to manually install and restart ColdFusion.  (CFX_HTTP5 also honors DNS TTL which I believe that isn't correctly honored by java.... it's either "never" or "forever", right?)   Another feature that benefited us was the ability to specify the specific TLS version we wanted so we could force TLS1.2 and not fall back to something less secure.