http://coldfusion.com logo
Join Slack
Powered by
So I just "solved" an issue with a client of mine....
# cfml-general
t
So I just "solved" an issue with a client of mine. They got a new certificate, and ColdFusion didn't like it. They'd get this error when the server tired to connect to itself.
I/O Exception: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
This was with the latest version of Oracle Java (11.0.27). We tried switching to Temurin 11.0.27.6, and then the connection was successful. Does anyone know what difference exists between the two that might have caused this? Since non-Oracle Java isn't something officially supported, I'm not a huge fan of this solution, and would love to get it working in Oracle Java too.
b
Likely related to the 
cacerts
file that ships with the respective JVMs
You'd have to provide more details about the cert in question, but that error means the CA which signed the cert isn't trusted
Java 11 is pretty old, so depending on when the build in question was created, it could have a pretty old list of CAs
d
The cert you installed might be missing a chained cert too, which can cause issues.
b
A newer cert may have been signed by a newer CA which wasn't included in the old JRE's trust store
It's true, you usually want to configure your server to use the cert chain, including any intermediate certs, but if the only difference between working/non-working was a JRE swap, then it would boil down to the CAs in the trust store of that JRE
t
it's not my cert -- it's theirs, so unfortunately I don't have more details. I was afraid that might be the answer.
b
(CA = Certificate Authority)
I mean, you can add whatever you want to your trust store
so use the JRE you want, and just trust the cert
t
FWIW, i was able to replicate it on CF2023 with 17.0.15, and CF2025 with 21.0.7 as well.
b
You can find out for certain if you want. You'd need to look at the CA which signed the cert chain, then inspect the cacerts in question and see if that CA is present
t
sure.
b
Often times it's not worth the trouble and people just trust the cert and move on
t
I'll take a look.
b
I like 
Portecle
for looking at trust stores. It's a GUI that runs out of a jar file
The default password on most 
cacerts
files is 
changeit
which you'll need to open the store
You can also post the cert (public key only, NOT the private key) and the 
cacerts
file in question
It's found in the 
security
folder if I recall inside the Java home
Also, I assume you mean Adobe CF. It's worth noting all versions of Lucee up until Lucee 6 packaged their own cacerts file which was used by default instead of the JRE's
👍 1
t
Yup. That appears to be the issue. And there's a bug filed to get it updated: https://bugs.openjdk.org/browse/JDK-8356452
q
Yeah, Sectigo has one of their CAs expire in 2026. So new certs are now being signed by it. That also means the intermediate certs need to be trusted/replaced as well
2 Views
Open in Slack
PreviousNext
Powered by