CFHTTP SSL Connection Failure

[Guest]

Hi,
About a month ago, I updated the SSL key for one of our websites called webA. One of our other websites, webB, on the same server is making a CFHTTP call to webA using SSL. This has worked fine for the past 2-3 years. It seems that after I renewed and installed the SSL key for webA, webB gets the following error when using CFHTTP:

Connection Failure: Status code unavailable <br>The error occurred on line 1.

I was reading this article that says CF doesn't support newer SSL keys using SSL v3.
http://www.talkingtree.com/blog/index.cfm/2006/11/14/ColdFusion-Protocol-Tags-CFHTTP-CFINVOKE-CFLDAP...

So, I tried using another JAVA library to simulate CFHTTP, but ran into the same problem
http://www.innovation.ch/java/HTTPClient/

So I started searching the SUN website and got a hint that perhaps the JVM was the problem. So I upgraded my JVM from j2sdk1.4.2_11 to j2sdk1.4.2_15

I tried again and my CFHTTP tag was working again and so was the java HTTPClient library I tried.

Has anyone else had this problem?
Has anyone tried and had any problems with using CF with j2sdk1.4.2_15 ? I don't think CF officially supports it.

I've only done this on our development server and need to perform more testing with this new JVM before putting into production.

Thank you for any feedback.,
Carlos Vazquez
Senior Web Developer / MySQL DBA

[Grizzly9279]

RE: the talkingtree.com article, I think you're confusing client certificates and server certificates. The talking tree article is discussing an SSLv3 issue with client certs. Server certs are a seperate animal altogether.

There should be no issue with updating (renewing?) the SSL certificate on "webA". Just make sure that the SSL cert being used by "webA" now, has a "common name" that matches the domain name you're using to address it with.
(I'm guessing you're simply using "webA" as the domain name, since it's all internal correct?)

One other thing to consider, what is the "Issuer" is on the new SSL cert? If the new cert was not issued by a globally trusted third party (like VeriSign/PayPal, or Thawte), than you may need to register the cert in JRun's "cacerts" file. You can read more about that here:

http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_19139&sliceId=1#enableCF

[Grizzly9279]

In case you need it, here's another (perhaps more useful) article on the "cacerts" keystore:

http://www.coldfusionmuse.com/index.cfm/2005/01/29/keystore