0

I'm not 100% sure what's going on however we have a Coldfusion 9 server that connects to a web service. the web service has made the changes to only allow connections via TLS 1.2. We thought we were ok because we set the server to only use TLS 1.2 and we set the JRE (1.7) to use tls 1.2. However in the Coldfusion Administrator -> Web services when I try to refresh the web service connection it still tries to connect via TLS 1.0 (confirmed using wireshark). Anyone that is well versed in coldfusion configuration able to point me in the right direction to understand why this is happening?

Thank you

Edit:

enter image description here

6
  • 1
    How did you set the server to only use TLS 1.2? Did you set the JVM config setting -Dhttps.protocols=TLSv1.2? Jun 8, 2018 at 20:20
  • Where do I set that? in the jvm.config file?
    – BDubCook
    Jun 8, 2018 at 21:06
  • We set the server to use TLS 1.2 by changing the registry keys (windows server) and we set java to use TLS 1.2 by changing it in the Java Control Panel. I added the above config setting to both the jvm.config file and the admin_jvm.config file and restarted the server and all the results are still the same
    – BDubCook
    Jun 8, 2018 at 21:14
  • 1
    AFAIK, the Windows registry and Java Control Panel have no impact on the CF Application Server. In CF Admin > Server Settings, are you seeing that it's using JDK 1.7? You would have to set that in the jvm.config, JAVA_HOME variable. Jun 8, 2018 at 22:56
  • Yes, according to the settings it's set to JDK 1.7 I added an image for clarification
    – BDubCook
    Jun 9, 2018 at 0:21

3 Answers 3

2

Upgrade your JDK/JRE to use 1.8 and that will solve this problem.

For basic instructions, read my answer on this question:

How to add TLS 1.2 in cfhttp tag in ColdFusion 10

The CF9 server that I support is running on Server JRE 1.8u172.

3
  • I downloaded and installed JDK 1.8_171 and pointed the coldfusion server to it. Now all of the sites and the administrator consoles load with just a blank page and nothing in the browser console The only thing I can get up and running it the Jrun Management Console and I can see one error in the log viewer of the application server coldfusion.server.ServiceFactory$ServiceNotAvailableException: The ClientScope service is not available
    – BDubCook
    Jun 10, 2018 at 0:00
  • What does the {ColdFusion9}\runtime\bin\jvm.config have around line 6? Does it point to the correct folder? Mine has "java.home=C:/Program Files/Java/jdk1.8.0_172/jre". You can edit this file to point back to your old JRE. You should also see a "jvm.config.bak" in this folder that has your previous JRE info in it. So, it is easy to drop back to previous versions if something didn't work right. Jun 10, 2018 at 23:38
  • What version of ColdFusion 9 are you running and what hotfixes are installed? Jun 10, 2018 at 23:41
0

Following Miguel-F's link and a few others, I discovered that CF 9 will ignore -Dhttps.protocols=TLSv1.2 for every version of JDK 7 until JDK 7u171 b31, but then JDK 7u181 enables TLSv1.2 by default (just like JDK 8).

The only hurdle is that any JDK past 7u80 is behind an Oracle paid support wall. I managed to find someone with access and it tested just fine using PayPal's TLS Test site:

<cfhttp url="https://tlstest.paypal.com/" result="test">

<cfdump var="#test#">

This returns a CFHTTP dump with PayPal_Connection_OK when a TLSv1.2 connection is used.

JDK 8u172 will also work with CF 9.0.2 w/ all hot fixes, but I'd rather not risk the regression testing jumping to the next major version.

-1

Very late answer, but you can't go wrong using cfx_http5. Better than cfhttp in every way.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.