Server upgrade options

3 views
Skip to first unread message

Brian Caufield

unread,
Oct 11, 2018, 2:27:14 PM10/11/18
to cfu...@googlegroups.com
Hi Folks,

I have been out of the Coldfusion scene for a while now but I have just been contacted by a client I did work for several years ago. They had CF 9.0.1 installed and they need to upgrade since they are getting flagged in security scans for using TLS 1.0. They tried upgrading to CF 9.0.2 and Java 1.8 and there are many errors getting thrown. What are the recommended CF and Java versions given this configuration? I hear the the Admin is broken on CF 10 and Java 1.8 - is that fixed in 11? Does it make sense to go to 11 or all the way to 2018?

Then there is the discussion about what underlying web server should they use - They are currently on a Windows server and are a Microsoft-only shop but have lost all their developers; does it make sense to go with Lucee and TomCat on a linux server? I did an upgrade to Railo a couple of years ago and that was not fun - Case sensitivity is a bitch and migrating the data to a MySQL was not fun but they are very cost conscious and I see the Coldfusion license as a major obstacle, Are there any issues with using MS SQL and a linux web server?

Finally, if anyone is excited about this project I will gladly recommend you - I think this is out of my league but any advice would be greatly appreciated.

Thanks in advance!

Brian Caufield 

charlie arehart

unread,
Oct 11, 2018, 8:10:16 PM10/11/18
to cfu...@googlegroups.com

Brian: CF9 and below don’t support Java 8, so TLS problems will be a bane for those users. To be clear, I’m not saying CF9 and below won’t WORK with Java 8: I said CF does not SUPPORT it (Adobe never updated CF9 or earlier to support it. They did update 10 and 11 to, and CF2016 came out on Java 8, like CF2018 comes out on Java 10).

So can someone on CF9 run with Java 8? Yes, it will come up. The question then is whether their app will have any issues.

When one upgrades CF’s underlying Java from one version to another, there are often issues due to the fact that CF compiles CF templates into Java classes and creates web service “stub” classes for web services that are called. Since those were compiled on the old JVM, it’s sometimes necessary to remove those (the cfclasses and stubs folders). Your client can google to find more on that, as it’s even bene documented by Adobe in past technotes and blog posts (when a given CF version DID support updating to a new JVM version). That may take care of some problems they may hit.

As for your saying that they “upgraded to 9.0.2”, that was going to be a killer for them right there. 9.0.2 was not an updater for CF 9 or 9.0.1. It was a complete installer of a new version, which primarily removed Verity. I have a blog post with more details on that, from that timeframe. But you or they may not care about that at this point.

Bottom line: I can say that I know (and have) clients who have updated CF9 to Java 8 and it worked fine. I’ve not had any who tried to do it and had problems where I could not solve it. You ask if anyone can help: I can. I don’t do development, but I do guide folks who want to do such things (installation, configuration, administration, migration, troubleshooting, tuning, security, etc.)  You can point them to carehart.org/consulting for more on my rates, approach, satisfaction guarantee and more.

That said, I can’t “guarantee” that they will be able to run CF9 on Java 8. I’m just saying I have helped some who were adamant not to upgrade to 10 or higher. (Of course, even 10 no longer has any public updates since 2017, and 11 will stop getting them in 2019.)


You say, “I hear the the Admin is broken on CF 10 and Java 1.8 - is that fixed in 11?”. I never heard of such an issue—and I help about 200 clients a year, so I don’t think that was a thing. Whoever had it or saw it had some issue that they simply did not solve. I can say, for instance, that many have (since CF10) applied the CF update mechanism (new and easier in 10 and above), and yet found CF either didn’t come up, or the admin didn’t come up, or their app stopped working. But in all cases I have helped with, the problem was instead an error during the update (that they did not notice, though it was indeed logged). I have a blog post on that, also, with more detail. You can find it and other things I refer folks to often at carehart.org/top.cfm.

Finally, you ask, “Does it make sense to go to 11 or all the way to 2018?” There’s no right or wrong there. Some do stop at 11, some go to 2018, and some stop at 2016. (I will say that just today I helped two different clients upgrading from CF *8* to CF2018. Of course, the larger the jump, the bigger the challenges as you are then dealing with compat issues that may exist between EACH of the versions—and you’re getting them ALL at once. There’s no good guide to the many things you can hit (since there are so many in each release, some little niggly things that few may hit), but again I help people with this stuff and can nearly always help resolve a compat issue (with a workaround, config change, or help putting in a needed change).

You then ask, “They are currently on a Windows server and are a Microsoft-only shop but have lost all their developers; does it make sense to go with Lucee and TomCat on a linux server?” Well, I don’t see the connection between losing developers and needing to move to Lucee or Tomcat or Linux. I understand a motivation to move to Lucee to avoid paying for CF (as well as some other benefits). I’m just saying I don’t see the first phrase motivating the move to any of the next 3.

Perhaps you are simply of the opinion that Linux and Apache are better than Windows and IIS. They’re not invariably so, but I know some do hold that opinion. Again FWIW I can say that 90% of the clients I work with are running CF on Windows—and some are dozens of servers and tens of millions of requests per day. To be clear, both CF and Windows/IIS are perfectly capable of such large volumes and high performance. Nearly all problems are just a matter of configuration and/or coding.

Hope that’s helpful. I suspect this could spawn some vigorous debate. Or maybe not. This is the first post in 6 months, and there’s not been many the past year. Some have moved on, others have indeed grown weary of debates. :-)

/charlie

--
You received this message because you are subscribed to the Google Groups "Central New York ColdFusion Users Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cfugcny+u...@googlegroups.com.
To post to this group, send email to cfu...@googlegroups.com.
Visit this group at https://groups.google.com/group/cfugcny.
For more options, visit https://groups.google.com/d/optout.

Brian Caufield

unread,
Oct 15, 2018, 8:48:22 AM10/15/18
to cfu...@googlegroups.com
Hi Charlie,

Thanks for the prompt reply. I believe they have rolled back the site to 9.0.1 and are considering the next steps. I will let you know if they are interested in your services.

Thanks again for your help,

Brian Caufield

Brian Caufield

unread,
Oct 24, 2018, 10:29:24 AM10/24/18
to cfu...@googlegroups.com
Hi folks,

I have tried the install of Java 8 on CF9 and while all the local content seems fine, there are errors trying to connect to a Sales Tax lookup web service (via WSDL) and connecting to the PayPal Payflow server. I have followed the update procedures detailed here: 

but the web service calls are still not working. I assumed PayPal was objecting to the lack of TLS 1.2 support and the Java update would address that issue but it still fails to connect.
 
While I have read from Pete and Charlie that you CAN run CF9 and Java 8, has anyone tried getting web services working with that combination? If I knew it was possible I will continue trying but this client doesn't have a Dev server (or functioning source code repository!) so any testing takes down the production site, limiting testing to late nights which is a real PITA.

Any help would be greatly appreciated,

Brian Caufield

Pete Freitag

unread,
Oct 24, 2018, 11:11:47 AM10/24/18
to cfu...@googlegroups.com
Hi Brian,

There are some ways you can attempt to disable TLS 1.0 and 1.1 at the JVM level.

You can tell the JVM what protocols you want to use by setting this JVM argument, this might work for web services but I don't think it will work for cfhttp:

-Dhttps.protocols=TLSv1.2 -Djdk.tls.client.protocols=TLSv1.2

I wrote a http client wrapper a few years ago that should respect these: https://github.com/foundeo/bolthttp and will be able to connect to TLS 1.2


--
Pete Freitag
foundeo.com - ColdFusion Consulting & Products
hackmycf.com - CFML Server Security Scanner
fuseguard.com - Web App Firewall for CFML


Brian Caufield

unread,
Oct 24, 2018, 11:34:54 AM10/24/18
to cfu...@googlegroups.com
Thanks Pete - I will give that a try!
Reply all
Reply to author
Forward
0 new messages