cfhttp gives a connection failure

[Nils]

Hello,

I don't understand the following problem:

The following line gives a simple "Connection Failure" as result:

<CFHTTP URL="https://www.pixabay.com/" METHOD="GET">

I have no problem with other https-sites. I have already imported the cert with lucee-serveradmin and with the keytool.

Is anybody able to connect to pixabay with lucee/cfhttp? Is there any hint for a solution?

Best regards,

Nils

[AJ Mercer]

I have this as well - have not been able to work out what is happening

In Lucee Server Admin, the SSL site can list and add the domain on port 443

Struct
charset	string
errordetail	string Unknown host: org.apache.http.impl.client.DefaultHttpClient.execute(Lorg/apache/http/client/methods/HttpUriRequest;Lorg/apache/http/protocol/HttpContext;)Lorg/apache/http/client/methods/CloseableHttpResponse;
filecontent	string Connection Failure
header	string
mimetype	string Unable to determine MIME type of file.
responseheader	Struct
statuscode	string Connection Failure. Status code unavailable.
text	boolean true

General Info

Version	Lucee 4.5.1.019 final
Version Name	Neo
Release date	01/06/2015
ColdFusion® compatibilty version	10.0.0.0

Configuration File	/opt/railo/lib/lucee-server/context/lucee-server.xml
OS	Linux (3.4.0) 32bit - UBUNTU
Remote IP	127.0.0.1
Host Name	webonix.net
Servlet Container
Java	1.7.0_25 (Oracle Corporation) 32bit
Architecture	32bit

--
You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/df2b3dca-f7f6-4867-ba89-48cc4a954b81%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

AJ Mercer
<webonix:net strength="Industrial" /> | <webonix:org community="Open" />
http://twitter.com/webonix

[Andrew Dixon]

You need to upgrade your JVM to the latest JVM so that you have the latest CACert authority file as it is not recognising the certificate authority and therefore refusing to connect and as such returning a connection failure.

Version 1.7.0_25 is from around June 2013, so about 2 years old.

Kind regards,

Andrew

about.me - mso - Lucee Association Member

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/CAPURtC0VZuRR06mFBZvL%2BY_qw5%3DS54U%2BbOY7n7Kp9KvK7pTcSA%40mail.gmail.com.

[Jordan Michaels]

Some additional info on this: there are a LOT of folks having issues right now with the fact that SSL is moving away from SHA1 to SHA2. Most SSL's issued in the last 6 months or so will be SHA2. If you're having a new connectivity issue spring up with code that's been working file for a while now, it's probably due to the move to SHA2 and the server you're connecting to has updated their SSL certificate. Almost always this can be corrected with a simple software update - similar to the JVM update Andrew mentions below. You may also have to re-import the servers public keys to your local JVM keystore if they're not chained to the CA's provided by the JVM.

-Jordan

----- Original Message -----
From: "Andrew Dixon" <andrew...@gmail.com>
To: lu...@googlegroups.com
Sent: Monday, June 22, 2015 4:26:35 PM
Subject: Re: [Lucee] cfhttp gives a connection failure

You need to upgrade your JVM to the latest JVM so that you have the latest
CACert authority file as it is not recognising the certificate authority
and therefore refusing to connect and as such returning a connection
failure.

Version 1.7.0_25 is from around June 2013, so about 2 years old.

Kind regards,

Andrew

about.me <http://about.me/andrew_dixon> - mso <http://www.mso.net> - Lucee
Association Member <http://lucee.org>

On 22 June 2015 at 23:36, AJ Mercer <ajme...@gmail.com> wrote:

> I have this as well - have not been able to work out what is happening
> In Lucee Server Admin, the SSL site can list and add the domain on port 443
>
> StructcharsetstringerrordetailstringUnknown host:
> org.apache.http.impl.client.DefaultHttpClient.execute(Lorg/apache/http/client/methods/HttpUriRequest;Lorg/apache/http/protocol/HttpContext;)Lorg/apache/http/client/methods/CloseableHttpResponse;

> filecontentstringConnection FailureheaderstringmimetypestringUnable to

> determine MIME type of file.responseheaderStructstatuscodestringConnection
> Failure. Status code unavailable.textbooleantrue
>
> General InfoVersionLucee 4.5.1.019 finalVersion NameNeo

> <https://www.facebook.com/neo.cfm>Release date01/06/2015ColdFusion®
> compatibilty version10.0.0.0
> Configuration File/opt/railo/lib/lucee-server/context/lucee-server.xmlOSLinux
> (3.4.0) 32bit - UBUNTURemote IP127.0.0.1Host Namewebonix.netServlet
> ContainerJava1.7.0_25 (Oracle Corporation) 32bitArchitecture32bit

>
> On 23 June 2015 at 06:31, Nils <ni...@bettinger.net> wrote:
>
>> Hello,
>>
>> I don't understand the following problem:
>>
>> The following line gives a simple "Connection Failure" as result:
>>
>> <CFHTTP URL="https://www.pixabay.com/" METHOD="GET">
>>
>> I have no problem with other https-sites. I have already imported the
>> cert with lucee-serveradmin and with the keytool.
>>
>> Is anybody able to connect to pixabay with lucee/cfhttp? Is there any
>> hint for a solution?
>>
>> Best regards,
>>
>> Nils
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Lucee" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to lucee+un...@googlegroups.com.
>> To post to this group, send email to lu...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/lucee/df2b3dca-f7f6-4867-ba89-48cc4a954b81%40googlegroups.com

>> <https://groups.google.com/d/msgid/lucee/df2b3dca-f7f6-4867-ba89-48cc4a954b81%40googlegroups.com?utm_medium=email&utm_source=footer>
>> .

>> For more options, visit https://groups.google.com/d/optout.
>>
>
>
>
> --
>

> *AJ Mercer*
> <webonix:net strength="Industrial" /> <http://webonix.net> | <webonix:org
> community="Open" /> <http://webonix.org>

> http://twitter.com/webonix
>
> --
> You received this message because you are subscribed to the Google Groups
> "Lucee" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to lucee+un...@googlegroups.com.
> To post to this group, send email to lu...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/lucee/CAPURtC0VZuRR06mFBZvL%2BY_qw5%3DS54U%2BbOY7n7Kp9KvK7pTcSA%40mail.gmail.com

> <https://groups.google.com/d/msgid/lucee/CAPURtC0VZuRR06mFBZvL%2BY_qw5%3DS54U%2BbOY7n7Kp9KvK7pTcSA%40mail.gmail.com?utm_medium=email&utm_source=footer>
> .

>
> For more options, visit https://groups.google.com/d/optout.
>

--

You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/CAG1WijVoQJ7s63uAx%3D7pQEB4epVyWgjUYnshqob7g60RCg79TA%40mail.gmail.com.

[Nils Bettinger]

Hi Andrew,

 

thank you very much for your analysis. This brings me back to my old problem: Java-Updates. I must confirm that I’ve never understood the version- and update-politics of Java. Obviously the older my Desktop-Systems are the more Java-Versions are on it. ;) I’m working on a windows-server. Can anyone give me a “howto” for this? I’m only able to update the desktop-version to V 8 Update 45, but that doesn’t has an effect on my Lucee-install.

 

Best regards,

 

Nils

 

 

 

From: Andrew Dixon

Sent: Tuesday, June 23, 2015 1:26 AM

To: lu...@googlegroups.com

Subject: Re: [Lucee] cfhttp gives a connection failure

 

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/CAG1WijVoQJ7s63uAx%3D7pQEB4epVyWgjUYnshqob7g60RCg79TA%40mail.gmail.com.

[Nils Bettinger]

Ok, I see: I have a jdk-directory within the railo/lucee-directory c:\railo\jdk – this is the old version. And I have an actual Java-Installation under C:\Program Files (x86)\Java\jre1.8.0_45

 

How can I tell Lucee to use the new Path – or do I have to copy the structure?

 

I would be pleased by any hint.

 

Best regards,

 

Nils

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/81C09D448E5041A1A10E4B5E714C702F%40SoulkeeperPC.

[Jordan Michaels]

Documentation is here:

https://github.com/getrailo/railo/wiki/Installation-InstallerDocumentation-MSUpgradingJRE

Kind regards,
Jordan Michaels

----- Original Message -----
From: "Nils Bettinger" <ni...@bettinger.net>
To: lu...@googlegroups.com

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/AFD1C3F105B548F1BA9C40DF7D4ABDFC%40SoulkeeperPC.

[David Eurenius]

Igal just posted an excellent post here.

https://groups.google.com/forum/#!topic/lucee/g7UeQec9G-U

[Nils Bettinger]

Yes, but unfortunately the result is the same: Connection failure. Eben with 1.8 Update 45 :-(

 

Probably the problem is somewhere else...  is anyone possible to get a result from pixaby with cfhttp?

    <CFHTTP URL="https://www.pixabay.com/" METHOD="GET">

I have no problem with other https-sites, but with pixabay. Spooky.

 

I’m still happy if anyone can help!

 

Best regards,

 

Nils

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/1edf103c-98d8-4fec-8b03-630d8136f50b%40googlegroups.com.

[Geoff Parkhurst]

Have you tried https://pixabay.com ?

With the "www" I get a 301 response...

> https://groups.google.com/d/msgid/lucee/5DEA44924DB2433097FB842C846A22A6%40SoulkeeperPC.

[Igal @ Lucee.org]

looks like the alternative name is not read properly.  the certificate's primary common name is set to:  www.pixabay.com  but the site redirects www to non-www.  the non-www is in the cert's alternative name:

 Unknown host: hostname in certificate didn't match: <pixabay.com> != <www.pixabay.de> OR <www.pixabay.de> OR <pixabay.de>

TBH I'm not sure where pixabay.de is coming from -- I don't see it in the certificate details.

can you please raise a ticket in the JIRA for that?
https://luceeserver.atlassian.net/

Igal Sapir
Lucee Core Developer
Lucee.org

[Vitaliy Krasheninnikov]

Hi,

The problem is in non-SNI TLS Client Hello from cfhttp. The server has pixabay.de certificate as a default on its 443 port. And pixabay.com is only reachable using the server name indication extension. You may check it here: https://www.ssllabs.com/ssltest/analyze.html?d=pixabay.com&hideResults=on (there is special notice about SNI).

I see a resolved LDEV-292 in jira, where Micha says this has been fixed in 4.5.1.019 with apache-commons-* jars updated manually, but I wasn't yet able to recheck it.

вторник, 23 июня 2015 г., 23:36:55 UTC+3 пользователь Igal написал:

[Igal @ Lucee.org]

Great!

@Nils -- what version of Lucee are you running?  if it's not the latest please update to the latest and test.

Igal Sapir
Lucee Core Developer
Lucee.org

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/647221e3-d8dc-4062-a89d-dd7bdf106b9c%40googlegroups.com.

[Konstantinos Liakos]

Igal, is right, you are on version 19 which had a problem. In order to update, remove the latest patch and then update again to the latest version.

[Nils Bettinger]

Now I’m on “Lucee 4.5.1.020 final”... unfortunately that brings no effect. The message ist still “Connection Failure”. :-(

 

Best regards,

 

Nils

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/fa1347f7-6c6e-4de3-903d-56365fdf3d94%40googlegroups.com.

[Konstantinos Liakos]

You additionally have to upadate the Lucee jars also. Check the last comments here https://luceeserver.atlassian.net/browse/LDEV-292.

[Nils Bettinger]

Ok. I have replaced

 

apache-commons-httpclient.jar

 

and added

 

apache-commons-httpcore.jar
apache-commons-httpmime.jar

After that the Railo/Lucee-Server don’t want to start again.

 

I’ve also restarted the whole server.

 

Error Code is 0

 

The System-Log says:

 

“Der Dienst "Railo Server" wurde mit folgendem dienstspezifischem Fehler beendet: Der Vorgang wurde erfolgreich beendet..”

[Service terminated with error: Process succesfully completed]

 

I have restored the old lib-directory again, but Railo/Lucee doesn’t start anymore.

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/40977577-f742-43f7-adbe-034907684415%40googlegroups.com.

[Konstantinos Liakos]

You have to replace 3 jars:

• apache-commons-httpclient.jar
  
• apache-commons-httpcore.jar
  
• apache-commons-httpmime.jar
  

You don't add any new ones. You have probably done something wrong, just try it from scratch.

[Nils Bettinger]

Yes, you are right – I looked at the apache-jakarta-commons-files. :) I replaced the three, but that makes Railo/Lucee start no more. Even after restoring the directory.

 

Ok, I will reinstall Lucee again.

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/20e8eda9-a4de-4558-bee2-a4e5b6773571%40googlegroups.com.

[AJ Mercer]

I updated the JRE

removed .019 then applied .019 & .020

installed SSL

... and all good now :-)

General Info

Version	Lucee 4.5.1.020 final
Version Name	Neo
Release date	04/06/2015
ColdFusion® compatibilty version	10.0.0.0

Configuration File	/opt/railo/lib/lucee-server/context/lucee-server.xml
OS	Linux (3.4.0) 32bit

Remote IP	127.0.0.1
Host Name	webonix.net
Servlet Container

Java	1.8.0_45 (Oracle Corporation) 32bit
Architecture	32bit

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/81C09D448E5041A1A10E4B5E714C702F%40SoulkeeperPC.

For more options, visit https://groups.google.com/d/optout.

[Konstantinos Liakos]

If you didn't replace the jars, and it works now, then your problem particularly didn't have to do with the SNI, it was just the bad Lucee patch.

[Nils Bettinger]

Ok, I can confirm: fresh Installation of Lucee 4.5.1.000 with Update to 4.5.1.020 and replacing the three Jars brings the solution. After importing the SSL, the Server can handle the cfhttp-request.

 

Unfortunately my productive-server which comes from Railo doesn’t take this way. But this is another problem.

 

Thanks to all who tested that out with me and thank you for pushing me in the right direction to get a fast solution before the next Version brings this bugfix anyway.

 

That helped me a lot! :-)

 

Best regards,

 

Nils

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/0227a7a0-126d-4a0b-bc02-3120c15d1019%40googlegroups.com.

[AJ Mercer]

in this case, it was with

    https://dynamic.zoneedit.com

​I have another cert at work I am having an issue with that I hope to get to soon. Will report back if that works now as well.​

[AJ Mercer]

yep, looks like it - same error

The SSL I am working with looks to be a self-signed wildcard certificate

cfhttp

Struct charset string errordetail string Unknown host: peer not authenticated

filecontent string Connection Failure header string mimetype string Unable to determine MIME type of file. responseheader Struct statuscode string Connection Failure. Status code unavailable. text boolean true

---

cfhttp https://pixabay.com/

Struct charset string errordetail string

Unknown host: hostname in certificate didn't match: <pixabay.com> != <www.pixabay.de> OR <www.pixabay.de> OR <pixabay.de>

filecontent string Connection Failure header string mimetype string Unable to determine MIME type of file. responseheader Struct statuscode string Connection Failure. Status code unavailable. text boolean true

General Info

Version	Lucee 4.5.1.021 final
Version Name	Neo
Release date	Jun 25, 2015
ColdFusion® compatibilty version	10.0.0.0

Configuration File	C:\websites\lucee45-jetty9\work\jetty-0.0.0.0-8080-lucee-4.5.1.000.war-_-any-\webapp\WEB-INF\lib\lucee-server\context\lucee-server.xml
OS	Windows 8.1 (6.3) 64bit
Remote IP	0:0:0:0:0:0:0:1
Host Name	localhost
Servlet Container	jetty/9.2.9.v20150224
Java	1.8.0_45 (Oracle Corporation) 64bit
Architecture	64bit

On 24 June 2015 at 22:48, Konstantinos Liakos <liakosko...@gmail.com> wrote:

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/0227a7a0-126d-4a0b-bc02-3120c15d1019%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Konstantinos Liakos]

The certificate is fine, the problem is they have multiple ssl certificates installed and served by the same ip address in the same webserver.

Latest Lucee with jar replacement fixes this problem, it's called SNI.

...

[AJ Mercer]

as in .021 patch

or download JARs?

--

You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/0c8faf1d-9a0c-40eb-b591-1e586200e8c2%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[AJ Mercer]

for those following at home

    https://luceeserver.atlassian.net/browse/LDEV-292

[AJ Mercer]

wow - that was a lot of hard work, but I can now access the HTTPS site with self-signed wildcard certificate.

But I too am in the same situation with Railo - time to migrate site*

Thank you to everyone that paved the way.

Hopefully all this will be rolled up into one easy install very soon.

* not a bad thing

[David Eurenius]

Hello everyone,

I got the same issue today with "hostname in certificate didn't match"

What was the outcome of this thread, is the solution just to add the .21 patch to Lucee and I'm all set?

Today I'm running 4.5.1.000.

...

[David Eurenius]

I'm trying to get scheduled tasks to run on an HTTPS site with SNI enabled as we are running several SSL sites on 1 IP.

I have added the .23 patch to Lucee.

Restarted the service.

I followed everything in this link: https://luceeserver.atlassian.net/browse/LDEV-429

Stopped Lucee

Downloaded httpclient-4.5.jar, httpmime-4.5.jar, httpcore-4.4.1.jar, placed all three file in the lucee/lib directory. (Removing the old ones apache-commons-http*.jar)

Started Lucee again.
Ran the scheduled task and the scheduler.log still outputs:

"ERROR","Thread-112","08/17/2015","22:34:26","","schedule task:[TASKNAME];Certificate for <SITE1> doesn't match any of the subject alternative names: [SITE2];javax.net.ssl.SSLException: Certificate for <SITE1> doesn't match any of the subject alternative names: [SITE2]

SITE1 = The site which tries to run the scheduled task.

SITE2 = Another site running on the same server where the scheduled tasks work on.

Both sites are configured with SNI enabled in IIS -> Bindings

Have I missed something here?

...