cfml

image.png

(ISSUE FIXED) This is a new error that I've never seen before.
siteA.mydomain.com is making a cfhttp request to <http://siteB.mydomain.com|siteB.mydomain.com>  This is the cfdump of the cfhttp result.

siteA is missing some algorithm it needs to decrypt siteB's response.  you can check what you've got with <https://www.ssllabs.com/ssltest/index.html>

So it has to be similar to this error: `
```unable to find valid certification path to requested target```


sure, missing some authority somewhere along the hierarchy

Ok so for that issue I use the keytool to add my cert to the JRE cacerts file. And that fixes it. I just did the same to siteA and it worked.

Makes sense since this Saturday I replace a CF server with a Commandbox managed CF server and I used the JRE that comes with Commandbox.

<@U0831QB98> Are you available for some consulting? We get our certificate from GlobalSign and I believe its the process in which I create my crt and key files that is wrong, because for some reason the JRE cacerts doesn't think my cert is valid. I've had to add my cert to JRE cacerts using the keytool for almost a decade now. Its easy, but I would like to know why its not recognized.

sorry i'm not, but even so i'm the last person you'd want to talk devops with :wink:

but there's plenty of others here that i'm sure will chime in

may want to start a new top level thread on it though if no one engages on this one

<@U0PNJPC31>, Have you solved the issue? I ask because I see "ISSUE FIXED" at the start.

If you are still looking for ideas, then I will say:
(1) your idea of importing the right certificates to the truststore, using the `keytool` tool,  is good. For example, to import a certificate in ColdFusion on Windows you would have done something like:
`keytool -import -v -alias myServerCert -file myServerCertFile.cer -keystore {HOME_DIR_OF_JAVA_ON_WHICH_CF_RUNS}\lib\security\cacerts -storepass changeit`

(2) if SSLLABS told you that your server uses TLS 1.x, then add the following flags to _java.args_ in ColdFusion's _jvm.config_:
 `-Djdk.tls.client.protocols=TLSv1.2,TLSv1.3 -Dhttps.protocols=TLSv1.2,TLSv1.3` 

Yes I have. I used the keytool to add my cert to the JRE cacerts file.

not familiar with globalsign, this is a long term cert?

i see, so you installed globalsign's CA cert?

so my understanding is if you just installed your cert, then it'll be good until it expires

but if you install the CA cert, then it'll be good until the CA changes it for signing for some reason

<https://support.globalsign.com/ca-certificates/root-certificates/globalsign-root-certificates>