cfhttp gives a connection failure

2297 views
Skip to first unread message

Nils

unread,
Jun 22, 2015, 6:31:08 PM6/22/15
to lu...@googlegroups.com
Hello,

I don't understand the following problem:

The following line gives a simple "Connection Failure" as result:

<CFHTTP URL="https://www.pixabay.com/" METHOD="GET">

I have no problem with other https-sites. I have already imported the cert with lucee-serveradmin and with the keytool.

Is anybody able to connect to pixabay with lucee/cfhttp? Is there any hint for a solution?

Best regards,

Nils

AJ Mercer

unread,
Jun 22, 2015, 6:36:46 PM6/22/15
to lu...@googlegroups.com
I have this as well - have not been able to work out what is happening
In Lucee Server Admin, the SSL site can list and add the domain on port 443

Struct
charset
string
errordetail
stringUnknown host: org.apache.http.impl.client.DefaultHttpClient.execute(Lorg/apache/http/client/methods/HttpUriRequest;Lorg/apache/http/protocol/HttpContext;)Lorg/apache/http/client/methods/CloseableHttpResponse;
filecontent
stringConnection Failure
header
string
mimetype
stringUnable to determine MIME type of file.
responseheader
Struct
statuscode
stringConnection Failure. Status code unavailable.
text
booleantrue

General Info

VersionLucee 4.5.1.019 final
Version NameNeo
Release date01/06/2015
ColdFusion® compatibilty version10.0.0.0

Configuration File/opt/railo/lib/lucee-server/context/lucee-server.xml
OSLinux (3.4.0) 32bit - UBUNTU
Remote IP127.0.0.1
Host Namewebonix.net
Servlet Container
Java1.7.0_25 (Oracle Corporation) 32bit
Architecture32bit

--
You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/df2b3dca-f7f6-4867-ba89-48cc4a954b81%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.



--

Andrew Dixon

unread,
Jun 22, 2015, 7:26:37 PM6/22/15
to lu...@googlegroups.com
You need to upgrade your JVM to the latest JVM so that you have the latest CACert authority file as it is not recognising the certificate authority and therefore refusing to connect and as such returning a connection failure.

Version 1.7.0_25 is from around June 2013, so about 2 years old.

Kind regards,

Andrew

Jordan Michaels

unread,
Jun 22, 2015, 7:38:54 PM6/22/15
to lu...@googlegroups.com
Some additional info on this: there are a LOT of folks having issues right now with the fact that SSL is moving away from SHA1 to SHA2. Most SSL's issued in the last 6 months or so will be SHA2. If you're having a new connectivity issue spring up with code that's been working file for a while now, it's probably due to the move to SHA2 and the server you're connecting to has updated their SSL certificate. Almost always this can be corrected with a simple software update - similar to the JVM update Andrew mentions below. You may also have to re-import the servers public keys to your local JVM keystore if they're not chained to the CA's provided by the JVM.

-Jordan



----- Original Message -----
From: "Andrew Dixon" <andrew...@gmail.com>
To: lu...@googlegroups.com
Sent: Monday, June 22, 2015 4:26:35 PM
Subject: Re: [Lucee] cfhttp gives a connection failure

You need to upgrade your JVM to the latest JVM so that you have the latest
CACert authority file as it is not recognising the certificate authority
and therefore refusing to connect and as such returning a connection
failure.

Version 1.7.0_25 is from around June 2013, so about 2 years old.

Kind regards,

Andrew
about.me <http://about.me/andrew_dixon> - mso <http://www.mso.net> - Lucee
Association Member <http://lucee.org>

On 22 June 2015 at 23:36, AJ Mercer <ajme...@gmail.com> wrote:

> I have this as well - have not been able to work out what is happening
> In Lucee Server Admin, the SSL site can list and add the domain on port 443
>
> StructcharsetstringerrordetailstringUnknown host:
> org.apache.http.impl.client.DefaultHttpClient.execute(Lorg/apache/http/client/methods/HttpUriRequest;Lorg/apache/http/protocol/HttpContext;)Lorg/apache/http/client/methods/CloseableHttpResponse;
> filecontentstringConnection FailureheaderstringmimetypestringUnable to
> determine MIME type of file.responseheaderStructstatuscodestringConnection
> Failure. Status code unavailable.textbooleantrue
>
> General InfoVersionLucee 4.5.1.019 finalVersion NameNeo
> <https://www.facebook.com/neo.cfm>Release date01/06/2015ColdFusion®
> compatibilty version10.0.0.0
> Configuration File/opt/railo/lib/lucee-server/context/lucee-server.xmlOSLinux
> (3.4.0) 32bit - UBUNTURemote IP127.0.0.1Host Namewebonix.netServlet
> ContainerJava1.7.0_25 (Oracle Corporation) 32bitArchitecture32bit
>
> On 23 June 2015 at 06:31, Nils <ni...@bettinger.net> wrote:
>
>> Hello,
>>
>> I don't understand the following problem:
>>
>> The following line gives a simple "Connection Failure" as result:
>>
>> <CFHTTP URL="https://www.pixabay.com/" METHOD="GET">
>>
>> I have no problem with other https-sites. I have already imported the
>> cert with lucee-serveradmin and with the keytool.
>>
>> Is anybody able to connect to pixabay with lucee/cfhttp? Is there any
>> hint for a solution?
>>
>> Best regards,
>>
>> Nils
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Lucee" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to lucee+un...@googlegroups.com.
>> To post to this group, send email to lu...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/lucee/df2b3dca-f7f6-4867-ba89-48cc4a954b81%40googlegroups.com
>> <https://groups.google.com/d/msgid/lucee/df2b3dca-f7f6-4867-ba89-48cc4a954b81%40googlegroups.com?utm_medium=email&utm_source=footer>
>> .
>> For more options, visit https://groups.google.com/d/optout.
>>
>
>
>
> --
>
> *AJ Mercer*
> <webonix:net strength="Industrial" /> <http://webonix.net> | <webonix:org
> community="Open" /> <http://webonix.org>
> http://twitter.com/webonix
>
> --
> You received this message because you are subscribed to the Google Groups
> "Lucee" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to lucee+un...@googlegroups.com.
> To post to this group, send email to lu...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/lucee/CAPURtC0VZuRR06mFBZvL%2BY_qw5%3DS54U%2BbOY7n7Kp9KvK7pTcSA%40mail.gmail.com
> <https://groups.google.com/d/msgid/lucee/CAPURtC0VZuRR06mFBZvL%2BY_qw5%3DS54U%2BbOY7n7Kp9KvK7pTcSA%40mail.gmail.com?utm_medium=email&utm_source=footer>
> .
>
> For more options, visit https://groups.google.com/d/optout.
>

--
You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/CAG1WijVoQJ7s63uAx%3D7pQEB4epVyWgjUYnshqob7g60RCg79TA%40mail.gmail.com.

Nils Bettinger

unread,
Jun 23, 2015, 2:03:09 AM6/23/15
to lu...@googlegroups.com
Hi Andrew,
 
thank you very much for your analysis. This brings me back to my old problem: Java-Updates. I must confirm that I’ve never understood the version- and update-politics of Java. Obviously the older my Desktop-Systems are the more Java-Versions are on it. ;) I’m working on a windows-server. Can anyone give me a “howto” for this? I’m only able to update the desktop-version to V 8 Update 45, but that doesn’t has an effect on my Lucee-install.
 
Best regards,
 
Nils
 
 
 
Sent: Tuesday, June 23, 2015 1:26 AM
Subject: Re: [Lucee] cfhttp gives a connection failure
 

Nils Bettinger

unread,
Jun 23, 2015, 2:40:40 AM6/23/15
to lu...@googlegroups.com
Ok, I see: I have a jdk-directory within the railo/lucee-directory c:\railo\jdk – this is the old version. And I have an actual Java-Installation under C:\Program Files (x86)\Java\jre1.8.0_45
 
How can I tell Lucee to use the new Path – or do I have to copy the structure?
 
I would be pleased by any hint.
 
Best regards,
 
Nils

Jordan Michaels

unread,
Jun 23, 2015, 2:40:19 PM6/23/15
to lu...@googlegroups.com
Documentation is here:

https://github.com/getrailo/railo/wiki/Installation-InstallerDocumentation-MSUpgradingJRE

Kind regards,
Jordan Michaels


----- Original Message -----
From: "Nils Bettinger" <ni...@bettinger.net>
To: lu...@googlegroups.com
To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/AFD1C3F105B548F1BA9C40DF7D4ABDFC%40SoulkeeperPC.

David Eurenius

unread,
Jun 23, 2015, 3:53:47 PM6/23/15
to lu...@googlegroups.com
Igal just posted an excellent post here.

Nils Bettinger

unread,
Jun 23, 2015, 4:13:45 PM6/23/15
to lu...@googlegroups.com
Yes, but unfortunately the result is the same: Connection failure. Eben with 1.8 Update 45 :-(
 
Probably the problem is somewhere else...  is anyone possible to get a result from pixaby with cfhttp?
    <CFHTTP URL="https://www.pixabay.com/" METHOD="GET">
I have no problem with other https-sites, but with pixabay. Spooky.
 
I’m still happy if anyone can help!
 
Best regards,
 
Nils

Geoff Parkhurst

unread,
Jun 23, 2015, 4:15:35 PM6/23/15
to lu...@googlegroups.com

Igal @ Lucee.org

unread,
Jun 23, 2015, 4:36:55 PM6/23/15
to lu...@googlegroups.com
looks like the alternative name is not read properly.  the certificate's primary common name is set to:  www.pixabay.com  but the site redirects www to non-www.  the non-www is in the cert's alternative name:

 Unknown host: hostname in certificate didn't match: <pixabay.com> != <www.pixabay.de> OR <www.pixabay.de> OR <pixabay.de>

TBH I'm not sure where pixabay.de is coming from -- I don't see it in the certificate details.

can you please raise a ticket in the JIRA for that?
https://luceeserver.atlassian.net/

Igal Sapir
Lucee Core Developer
Lucee.org

Vitaliy Krasheninnikov

unread,
Jun 23, 2015, 7:09:53 PM6/23/15
to lu...@googlegroups.com

Hi,

The problem is in non-SNI TLS Client Hello from cfhttp. The server has pixabay.de certificate as a default on its 443 port. And pixabay.com is only reachable using the server name indication extension. You may check it here: https://www.ssllabs.com/ssltest/analyze.html?d=pixabay.com&hideResults=on (there is special notice about SNI).

I see a resolved LDEV-292 in jira, where Micha says this has been fixed in 4.5.1.019 with apache-commons-* jars updated manually, but I wasn't yet able to recheck it.


вторник, 23 июня 2015 г., 23:36:55 UTC+3 пользователь Igal написал:

Igal @ Lucee.org

unread,
Jun 23, 2015, 7:59:36 PM6/23/15
to lu...@googlegroups.com
Great!

@Nils -- what version of Lucee are you running?  if it's not the latest please update to the latest and test.


Igal Sapir
Lucee Core Developer
Lucee.org

Konstantinos Liakos

unread,
Jun 24, 2015, 4:29:19 AM6/24/15
to lu...@googlegroups.com
Igal, is right, you are on version 19 which had a problem. In order to update, remove the latest patch and then update again to the latest version.

Nils Bettinger

unread,
Jun 24, 2015, 9:39:08 AM6/24/15
to lu...@googlegroups.com
Now I’m on “Lucee 4.5.1.020 final”... unfortunately that brings no effect. The message ist still “Connection Failure”. :-(
 
Best regards,
 
Nils

Konstantinos Liakos

unread,
Jun 24, 2015, 9:47:18 AM6/24/15
to lu...@googlegroups.com
You additionally have to upadate the Lucee jars also. Check the last comments here https://luceeserver.atlassian.net/browse/LDEV-292.

Nils Bettinger

unread,
Jun 24, 2015, 10:15:27 AM6/24/15
to lu...@googlegroups.com
Ok. I have replaced
 
apache-commons-httpclient.jar
 
and added
 
apache-commons-httpcore.jar
apache-commons-httpmime.jar
After that the Railo/Lucee-Server don’t want to start again.
 
I’ve also restarted the whole server.
 
Error Code is 0
 
The System-Log says:
 
Der Dienst "Railo Server" wurde mit folgendem dienstspezifischem Fehler beendet: Der Vorgang wurde erfolgreich beendet..
[Service terminated with error: Process succesfully completed]
 
I have restored the old lib-directory again, but Railo/Lucee doesn’t start anymore.

Konstantinos Liakos

unread,
Jun 24, 2015, 10:28:06 AM6/24/15
to lu...@googlegroups.com
You have to replace 3 jars:
  • apache-commons-httpclient.jar
  • apache-commons-httpcore.jar
  • apache-commons-httpmime.jar
You don't add any new ones. You have probably done something wrong, just try it from scratch.

Nils Bettinger

unread,
Jun 24, 2015, 10:32:17 AM6/24/15
to lu...@googlegroups.com
Yes, you are right – I looked at the apache-jakarta-commons-files. :) I replaced the three, but that makes Railo/Lucee start no more. Even after restoring the directory.
 
Ok, I will reinstall Lucee again.

AJ Mercer

unread,
Jun 24, 2015, 10:34:01 AM6/24/15
to lu...@googlegroups.com
I updated the JRE
removed .019 then applied .019 & .020
installed SSL

... and all good now :-)

General Info

VersionLucee 4.5.1.020 final
Version NameNeo
Release date04/06/2015
ColdFusion® compatibilty version10.0.0.0

Configuration File/opt/railo/lib/lucee-server/context/lucee-server.xml
OSLinux (3.4.0) 32bit
Remote IP127.0.0.1
Host Namewebonix.net
Servlet Container
Java1.8.0_45 (Oracle Corporation) 32bit
Architecture32bit


For more options, visit https://groups.google.com/d/optout.

Konstantinos Liakos

unread,
Jun 24, 2015, 10:48:42 AM6/24/15
to lu...@googlegroups.com
If you didn't replace the jars, and it works now, then your problem particularly didn't have to do with the SNI, it was just the bad Lucee patch.

Nils Bettinger

unread,
Jun 25, 2015, 1:04:38 AM6/25/15
to lu...@googlegroups.com
Ok, I can confirm: fresh Installation of Lucee 4.5.1.000 with Update to 4.5.1.020 and replacing the three Jars brings the solution. After importing the SSL, the Server can handle the cfhttp-request.
 
Unfortunately my productive-server which comes from Railo doesn’t take this way. But this is another problem.
 
Thanks to all who tested that out with me and thank you for pushing me in the right direction to get a fast solution before the next Version brings this bugfix anyway.
 
That helped me a lot! :-)
 
Best regards,
 
Nils

AJ Mercer

unread,
Jun 25, 2015, 1:54:02 AM6/25/15
to lu...@googlegroups.com
in this case, it was with

​I have another cert at work I am having an issue with that I hope to get to soon. Will report back if that works now as well.​

AJ Mercer

unread,
Jun 25, 2015, 3:51:56 AM6/25/15
to lu...@googlegroups.com
yep, looks like it - same error
The SSL I am working with looks to be a self-signed wildcard certificate

cfhttp
Struct
charset
string
errordetail
stringUnknown host: peer not authenticated
filecontent
stringConnection Failure
header
string
mimetype
stringUnable to determine MIME type of file.
responseheader
Struct
statuscode
stringConnection Failure. Status code unavailable.
text
booleantrue

cfhttp https://pixabay.com/
Struct
charset
string
errordetail
string
Unknown host: hostname in certificate didn't match: <pixabay.com> != <www.pixabay.de> OR <www.pixabay.de> OR <pixabay.de>
filecontent
stringConnection Failure
header
string
mimetype
stringUnable to determine MIME type of file.
responseheader
Struct
statuscode
stringConnection Failure. Status code unavailable.
text
booleantrue

General Info

VersionLucee 4.5.1.021 final
Version NameNeo
Release dateJun 25, 2015
ColdFusion® compatibilty version10.0.0.0

Configuration FileC:\websites\lucee45-jetty9\work\jetty-0.0.0.0-8080-lucee-4.5.1.000.war-_-any-\webapp\WEB-INF\lib\lucee-server\context\lucee-server.xml
OSWindows 8.1 (6.3) 64bit
Remote IP0:0:0:0:0:0:0:1
Host Namelocalhost
Servlet Containerjetty/9.2.9.v20150224
Java1.8.0_45 (Oracle Corporation) 64bit
Architecture64bit


On 24 June 2015 at 22:48, Konstantinos Liakos <liakosko...@gmail.com> wrote:

For more options, visit https://groups.google.com/d/optout.

Konstantinos Liakos

unread,
Jun 25, 2015, 4:12:47 AM6/25/15
to lu...@googlegroups.com
The certificate is fine, the problem is they have multiple ssl certificates installed and served by the same ip address in the same webserver.

Latest Lucee with jar replacement fixes this problem, it's called SNI.
...

AJ Mercer

unread,
Jun 25, 2015, 4:44:53 AM6/25/15
to lu...@googlegroups.com
as in .021 patch
or download JARs?

--
You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

AJ Mercer

unread,
Jun 25, 2015, 5:09:00 AM6/25/15
to lu...@googlegroups.com
for those following at home

AJ Mercer

unread,
Jun 25, 2015, 5:14:54 AM6/25/15
to lu...@googlegroups.com
wow - that was a lot of hard work, but I can now access the HTTPS site with self-signed wildcard certificate.

But I too am in the same situation with Railo - time to migrate site*

Thank you to everyone that paved the way.
Hopefully all this will be rolled up into one easy install very soon.


* not a bad thing

David Eurenius

unread,
Aug 17, 2015, 8:58:01 AM8/17/15
to Lucee
Hello everyone,

I got the same issue today with "hostname in certificate didn't match"
What was the outcome of this thread, is the solution just to add the .21 patch to Lucee and I'm all set?

Today I'm running 4.5.1.000.

...

David Eurenius

unread,
Aug 17, 2015, 4:54:52 PM8/17/15
to Lucee
I'm trying to get scheduled tasks to run on an HTTPS site with SNI enabled as we are running several SSL sites on 1 IP.

I have added the .23 patch to Lucee.
Restarted the service.
I followed everything in this link: https://luceeserver.atlassian.net/browse/LDEV-429
Stopped Lucee
Downloaded httpclient-4.5.jar, httpmime-4.5.jar, httpcore-4.4.1.jar, placed all three file in the lucee/lib directory. (Removing the old ones apache-commons-http*.jar)
Started Lucee again.
Ran the scheduled task and the scheduler.log still outputs:

"ERROR","Thread-112","08/17/2015","22:34:26","","schedule task:[TASKNAME];Certificate for <SITE1> doesn't match any of the subject alternative names: [SITE2];javax.net.ssl.SSLException: Certificate for <SITE1> doesn't match any of the subject alternative names: [SITE2]

SITE1 = The site which tries to run the scheduled task.
SITE2 = Another site running on the same server where the scheduled tasks work on.

Both sites are configured with SNI enabled in IIS -> Bindings

Have I missed something here?

...
Reply all
Reply to author
Forward
0 new messages