Sudden error with CFHTTP ans SSL

[hofar...@houseoffusion.com]

Hi,
I have an application under CF 9 with a paiment module using Paypal.
At the end of the process, Paypal acknowledges the paiement and my app calls a Paypal page to validate the whole operation. This is done with a CFHTTP call
This application has been working fine for years with no modification, bur all of a sudden starting March 23rd, I get this error:
I/O Exception: peer not authenticated
It appears to be an error with the SSL certificate, but how come ?
The Paypal site is verified by Verisign.
What ca I do?


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion
Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360318

[hofar...@houseoffusion.com]

What is the URL and does the domain name match the certificate exactly,
meaning not a wildcard certificate. Could be PayPal updated their SSL
certificate and is either a wildcard certificate or multi-site/domain
certificate (not sure what these are really called).

CF will not like it if the domain is www.domain.com, but the certificate is
*.domain.com. In this case, you need to import the certificate to the java
cacerts as a trusted certificate to by-pass the security matching.

You can either do this from the command line, or by far the easier route is
this extension to CF admin.

http://certman.riaforge.org/

https://www.google.com/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=import+ssl+certificate+coldfusion+9+to+cacerts

~Byron

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360319

[hofar...@houseoffusion.com]

I also once solved this by editing the hosts file on the server and adding
lines to force the name on the cert to point to the right IP.

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360321

[hofar...@houseoffusion.com]

>>Could be PayPal updated their SSL

It must be the problem, because I have other paiement services and they have no problem.
I'm trying your suggestion, thanks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360328

[hofar...@houseoffusion.com]

>>you need to import the certificate to the java
cacerts as a trusted certificate to by-pass the security matching.

That was the trick. I imported the Paypal certificate and now it works.
Thanks a lot.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360349

[hofar...@houseoffusion.com]

When I read these messages, I checked one of my old websites that
uses paypal integration services and found that it stopped
working. Payments were getting processed but the results
confirmation didn't work. This is on Coldfusion 8.
Thanks to this thread I found the problem and fixed it.. but just to
make it faster for others...
the certificate needed is the Verisign G5 certificate which you can
get at
https://knowledge.verisign.com/support/mpki-for-ssl-support/index?page=content&actp=CROSSLINK&id=SO5624

To see if you have it installed - and to install it if you don't, use:

https://github.com/webdevsourcerer/CF-CertMan
and install the version for your coldfusion version.

After installing, you need to restart the cold fusion service.

For those that like details, the paypal notice is at
https://ppmts.custhelp.com/ci/fattach/get/471495/1425083092/redirect/1/filename/2015%20Merchant%20Security%20System%20Upgrade%20Guide%20(U.S.%20English).pdf

Thanks

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360367

[hofar...@houseoffusion.com]

>>Payments were getting processed but the results
confirmation didn't work. This is on Coldfusion 8.

That was exactly the problem, on CF 9 also.

>>the certificate needed is the Verisign G5 certificate

In my case, the certificate I got from the Paypal site was a Symantec certificate.
That is probably the problem: Paypal must have moved from Verisign to Symantec, which is logical since both Paypal ans Symantec are owned by eBay.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360368

[hofar...@houseoffusion.com]

Verisign certificate products have been taken over by Symantec.

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360369

[hofar...@houseoffusion.com]

So then is the symantec certificate newer? Should I also add
that? What is the link to it? They have so many certificates on paypal

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360371

[hofar...@houseoffusion.com]

Best option is to contact PayPal support with that question. They should be
able to point you to the valid certs.

Good luck, Michael

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360372

[hofar...@houseoffusion.com]

Paypal support is useless. I contacted them 3 times for another issue
last week and they couldn't help at all

At 04:11 PM 4/3/2015, you wrote:
>Best option is to contact PayPal support with that question. They should be
>able to point you to the valid certs.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Order the Adobe Coldfusion Anthology now!
http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion

Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:360373