When trying to connect to an HTTPS site using the cfhttp tag, the tag may produce the error:
Unable to connect to SSL site error
To use HTTPS with the cfhttp tag, you might need to manually import the certificate for each web server into the keystore for the JRE that ColdFusion uses. This procedure may not be necessary if the certificate is signed (issued) by an authority that the JSSE (Java Secure Sockets Extension) recognizes (for example, Verisign); that is, if the signing authority is in the cacerts already. This procedure should only be necessary if the server URL is not in any of the certificates and they have not expired.
However, you might need to use the procedure if you are issuing SSL (secure sockets layer) certificates yourself. The instructions below show how to install a certificate into a ColdFusion 8 keystore, multi-server install.
- Place the certificate on the ColdFusion server.
- Change to the directory {cf_installdirectory}/jre/lib/security
- Import the cert (keytool -import -trustcacerts -keystore cacerts -storepass changeit -noprompt -alias anyalias -file certificatefile)
- If the import is successful you will get a confirmation that the certificate was added to the keystore.
- Restart coldfusion.
This procedure can also be helpful if scheduled tasks that connect to SSL servers are not running.
I am trying to understand something… When I performed the import of the certificate recently the Admin explained that I imported the cert for Solaris. Can you elaborate on why it did not just get installed to the Coldfusion keystore automatically??
First, you have a very smart admin to figure that out. You imported the cert into the default Solaris Java keystore. You need to specify the full path to the ColdFusion keystore when installing the cert.