ColdFusion CFHTTP and SSL Certs

 

Background: I have an ongoing problem with a Connection Failure error message when I try connecting to an API using CFHTTP. While reviewing the API in SoapUI I noticed there was a button SSL Info (3 certs) which is outlined below. When I click the button a window of copy pops up with the headlines outlined below.

"SSL Info (3 certs)" 

CipherSuite:

PeerPrincipal

Peer Certificate 1:

Peer Certificate 2:

Peer Certificate 3:

I have a feeling these are the key to getting my application to connect and pull the JSON correctly.

Question: How or Where do I install this cert information. Should I copy all 310 lines in the window with the cert information and place it in new file and save it somewhere?

Any info would be great.

I have answered the question of installing certificates before. Here are the steps again to save you from searching...

If you are using cfhttp to connect via SSL (https) then the ColdFusion server definitely needs the certificate installed to successfully connect. Here is a previous answer that I gave on a similar issue:

Here are the steps you need to perform in order to install the certificate to the Java keystore for ColdFusion. First, be sure you are updating the correct cacerts file that ColdFusion is using. In case you have more than one JRE installed on that server. You can verify the JRE ColdFusion is using from the administrator under the 'System Information'. Look for the Java Home line.

The default truststore is the JRE's cacerts file. This file is typically located in the following places:

  • Server Configuration:

    cf_root/runtime/jre/lib/security/cacerts

  • Multiserver/J2EE on JRun 4 Configuration:

    jrun_root/jre/lib/security/cacerts

  • Sun JDK installation:

    jdk_root/jre/lib/security/cacerts

  • Consult documentation for other J2EE application servers and JVMs

    • In order to install the certificate you need to first get a copy of the certificate. This can be done by using Internet Explorer. Note that different versions of Internet Explorer will behave slightly differently but should be very similar to these steps. For example, earlier versions of IE might save the certificate under a different tab than I mention.

  • Browse to the SSL URL in Internet Explorer - https://xyz/infoLookup.php?wsdl .
  • View the certificate by clicking on the lock icon and clicking view certificate
  • Then click the Install Certificate... button (note: if you do not see this button you must close IE and run it as administrator first)
  • Click on IE's Internet Options and click the Content tab
  • Click the Certificates button
  • Find the server's certificate under the Intermediate Certification Authorities tab, select the cert and click the Export... button
  • Export using DER format

    • Copy the exported certificate file to your ColdFusion server (you can delete the cert from IE if you want)

  • Run cmd prompt as administrator on the ColdFusion server
  • Make a backup of the original cacerts file in case you run into issues

    • The keytool is part of the Java SDK and can be found in the following places:

  • Server Configuration:

    cf_root/runtime/bin/keytool

  • Multiserver/J2EE on JRun 4 Configuration:

    jrun_root/jre/bin/keytool

  • Sun JDK installation:

    jdk_root/bin/keytool

  • Consult documentation for other J2EE application servers and JVMs

    • To install the cert:

  • Change directory to your truststore's location (where the cacerts file is located)
  • Type this command (use current jvm and use current jvm's keytool) "c:program filesjavajre7binkeytool" -import -v -alias your_cert_alias_name -file C:wherever_you_saved_the_filecert_file.cer -keystore cacerts -storepass changeit
  • Type yes at the prompt to "Trust this certificate?"

    • Note: your_cert_alias_name I used above can be whatever you want
    Note: C:wherever_you_saved_the_filecert_file.cer change these values to whatever you use for the server folder and certificate file name

    To verify the cert:

  • Type this command (use current jvm and use current jvm's keytool) "c:program filesjavajre7binkeytool" -list -v -keystore cacerts -alias your_cert_alias_name -storepass changeit

    • Note: your_cert_alias_name use the same name here that you used above to install the cert

    Restart the ColdFusion service It will not read the updated cacerts file until you do this.

    You can delete the imported certificate file from the server if you wish.

    链接地址: http://www.djcxy.com/p/5288.html

    上一篇: 角度2通用，nodejs中的身份验证

    下一篇: ColdFusion CFHTTP和SSL Certs