Highlighted

Accept all SSL certificates (bypass truststore)

Community Beginner ,
Aug 22, 2018

Copy link to clipboard

Copied

Hi,

Is it possible to allow all HTTPS calls from ColdFusion/Java to be accepted and not check against the truststore? Looking to not have to reboot CF each time a new SSL needs applying onto a server.

Cheers,

Correct answer by JonOnTheWeb | Community Beginner

Assuming as fixed as nothing that can be done apart from use Lucee instead.

Views

672

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more

Accept all SSL certificates (bypass truststore)

Community Beginner ,
Aug 22, 2018

Copy link to clipboard

Copied

Hi,

Is it possible to allow all HTTPS calls from ColdFusion/Java to be accepted and not check against the truststore? Looking to not have to reboot CF each time a new SSL needs applying onto a server.

Cheers,

Correct answer by JonOnTheWeb | Community Beginner

Assuming as fixed as nothing that can be done apart from use Lucee instead.

Views

673

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Aug 22, 2018 0
LEGEND ,
Aug 22, 2018

Copy link to clipboard

Copied

The truststore is there for a reason.  Bypassing it, you get what you deserve.

V/r,

^ _ ^

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Aug 22, 2018 0
Community Beginner ,
Aug 22, 2018

Copy link to clipboard

Copied

Then Adobe needs to build a better system for managing them as the current system is pretty poor. Valid SSLs should only be allowed to be called but with ever changing SSL providers and updated SSLs CF/Java doesn't seem to keep up.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Aug 22, 2018 0
Adobe Community Professional ,
Aug 22, 2018

Copy link to clipboard

Copied

This isn't really an Adobe problem, it's a problem with how certificate trust works and how Java works. The certificate trust system is kind of broken, really, and Java application servers don't let you dynamically load certificates into the keystore. Because ColdFusion runs on a Java application server, they're kind of held hostage by what that server does. So, it's complicated, and it's unrealistic to expect Adobe to fix that. The real fix for these sorts of general issues is to have a pool of servers rather than one individual server, so that you can make changes to a server (or an underlying container running said server like Docker etc) then you replace the running servers in the pool.

Dave Watts, Fig Leaf Software

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Aug 22, 2018 1
Community Beginner ,
Aug 22, 2018

Copy link to clipboard

Copied

I do understand it is within Java the issue but Adobe could make their end work better - take Lucee for example, much easier system and works straight out of the box from within their admin (Enter URL, confirm port, click install => Done).

EDIT:

Also to say the real fix is to add more servers with CF and have pools etc is very Adobe like - just pay more money and it will be fine.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Aug 22, 2018 0
Community Beginner ,
Aug 22, 2018

Copy link to clipboard

Copied

Assuming as fixed as nothing that can be done apart from use Lucee instead.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Aug 22, 2018 0
Jamo LATEST
Engaged ,
Aug 22, 2018

Copy link to clipboard

Copied

We once consumed a third-party API that would occasionally change IPs because it was "in the cloud" and they couldn't control their IP.  (I believe SparkPost's SMTP gateway is like this too.)   To avoid "forever DNS" issues and accept invalid/unknown SSL certificates, we used CFX_HTTP5 and enabled the SSLERRORS="OK" flag.  It allowed us to ignore certificate errors as well as automatically use any of the Windows SSL certificates without ever having to manually install and restart ColdFusion.  (CFX_HTTP5 also honors DNS TTL which I believe that isn't correctly honored by java.... it's either "never" or "forever", right?)   Another feature that benefited us was the ability to specify the specific TLS version we wanted so we could force TLS1.2 and not fall back to something less secure.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Aug 22, 2018 0