cfhttp and letsencrypt ssl

Explorer ,
Apr 13, 2021 Apr 13, 2021

Copy link to clipboard

Copied

Hi all,

i have a problem.

If i try cfhttp with google

 

https://www.google.de

 

All is fine.

If i try it with my own site with ssl by letsencrypt, it shows 

Connection Failure

 

What shall i do?

Why dont accept the letsencrypt cert?

I have Coldfusion 2016 and Ubuntu 16 / Apache

 

Kindly Regards

Thorsten

 

 

Views

127

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines

correct answers 3 Correct Answers

Enthusiast , Apr 14, 2021 Apr 14, 2021
The version of java that you are using is 1.8.0_72, which is very old. My guess is that the cacerts file included in that version of java doesn't have Let's Encrypt listed as a trusted certificate authority. The easiest way to fix that is to simply update the JVM, you can grab the latest version of Java 1.8 from Adobe here: https://www.adobe.com/support/coldfusion/downloads.html  Here's some info on updating the JVM in ColdFusion including a video howto: https://www.petefreitag.com/item/860.cfm ...

Likes

Translate

Translate
Adobe Community Professional , Apr 14, 2021 Apr 14, 2021
Thanks as always for your insights, Pete. And if it may interest some readers, I have a post with even more detail (than Pete's there) on the matter of how it's so important to upate the JVM that CF uses, to fix most problems of CF calling out via https, whether with cfhttp or other things. That post is here, Solving problems calling out of CF via https, by updating JVM.

Likes

Translate

Translate
Adobe Community Professional , Apr 16, 2021 Apr 16, 2021
@tims4831424 :     If i try cfhttp with google  https://www.google.de     All is fine. That is because Google continues to enable the older TLS 1.0 and TLS 1.1. Which is, generally speaking, not optimal. The general recommendation now is to support TLS 1.2 or TLS 1.3. Your Java version,  1.8.0_72, is too old for these security protocols. For example, support for TLS 1.3 was introduced in Java 1.8.0_261. Therefore, as Pete and Charlie suggest, you should upgrade the Java that ColdFusion 201...

Likes

Translate

Translate
Enthusiast ,
Apr 13, 2021 Apr 13, 2021

Copy link to clipboard

Copied

Hi Thorsten,

 

I can confirm that cfhttp to a site using Let's Encrypt for https does infact work with CF2016, but there are a few things I can think of that might be causing the problem. I think I have summarized them all here in this blog entry: https://www.petefreitag.com/item/852.cfm 

 

The TLDR is:

1) Version of Java you are using might be too old

2) Your server might be missing the intermediate cert in its config, use https://whatsmychaincert.com/ to test it.

 

Hope that helps

Pete Freitag

Foundeo Inc.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Explorer ,
Apr 14, 2021 Apr 14, 2021

Copy link to clipboard

Copied

Hi Pete,

the cert of Letsencypt is correct  fullchain and privkey..

 

and this is my coldfusion and java version

Attache the Screenshot from the Server with Version numbers

 

And for Example this site:

https://www.druckhaus-w2p.de

 

Kindly Regards

Thorsten

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Enthusiast ,
Apr 14, 2021 Apr 14, 2021

Copy link to clipboard

Copied

The version of java that you are using is 1.8.0_72, which is very old. My guess is that the cacerts file included in that version of java doesn't have Let's Encrypt listed as a trusted certificate authority. The easiest way to fix that is to simply update the JVM, you can grab the latest version of Java 1.8 from Adobe here: https://www.adobe.com/support/coldfusion/downloads.html 

 

Here's some info on updating the JVM in ColdFusion including a video howto: https://www.petefreitag.com/item/860.cfm

 

 

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Community Professional ,
Apr 14, 2021 Apr 14, 2021

Copy link to clipboard

Copied

Thanks as always for your insights, Pete. And if it may interest some readers, I have a post with even more detail (than Pete's there) on the matter of how it's so important to upate the JVM that CF uses, to fix most problems of CF calling out via https, whether with cfhttp or other things. That post is here, Solving problems calling out of CF via https, by updating JVM.


/Charlie (server troubleshooter, carehart.org)

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Community Professional ,
Apr 16, 2021 Apr 16, 2021

Copy link to clipboard

Copied

LATEST

@tims4831424 :

    If i try cfhttp with google  https://www.google.de

    All is fine.

 

That is because Google continues to enable the older TLS 1.0 and TLS 1.1. Which is, generally speaking, not optimal.

 

The general recommendation now is to support TLS 1.2 or TLS 1.3. Your Java version,  1.8.0_72, is too old for these security protocols. For example, support for TLS 1.3 was introduced in Java 1.8.0_261.

 

Therefore, as Pete and Charlie suggest, you should upgrade the Java that ColdFusion 2016 uses. Before that, make sure you upgrade ColdFusion 2016 to the latest update level (currently Update 17).

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines