I'm having some issues using sslCertificateInstallI() on lucee6. I'm trying to add a self-signed cert from another server. This works locally when using commandbox, but on our staging server I still get the following error doing cfhttp to the remote hostL

Unknown host: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

However, when I do

SSLCertificateList()

the certificate is there?? Anyone any idea what the issue might be?

I think Lucee 6 now uses the JRE cacerts instead of its own by default, which means

sslCertificateInstall()

no longer has any effect. To enable the previous behaviour you can use the environment variable

LUCEE_USE_LUCEE_SSL_TRUSTSTORE=1

, or better add the certificate to your JRE's truststore.

Yep you're right - thanks for the help!

I still wish Lucee had kept their keystore and setup a delegating keystore (which delegates out to the JRE keystore) as had been suggested in their JIRA. There were a lot of benefits to having its own keystore, and that would have been the best of both worlds. Instead, the baby got thrown out with the bathwater 😕