coldfusion 2016 cfhttp call to authorize.net returning connection failure

1
votes

I'm trying to use a cfhttp post to secure.authorize.net/gateway/transact.dll, but am getting a connection failure. I'm using coldfusion 2016 on windows server 2008. I believe I have the correct cert file registered in the java keystore but am not 100% sure. Based on some google searches, I think that is the problem.

I downloaded and registered GeoTrust Primary Certification Authority - G2 from https://www.geotrust.com/resources/root-certificates/ Any tips on how to make sure the proper sha-2 certificate is registered in the keystore? I tried using IE to save the certificate from secure.authorize.net/gateway/transact.dll, by following the instructions here https://www.youtube.com/watch?v=ewT4aud-xww but that also didn't seem to work.

I should add that this wasn't working even before the TLS disablement date of yesterday. That was just a coincidence. I previously had CF 9 installed, and it was working on there. From what I've always understood, the communication failure error usually indicates lack of or incorrectly imnported certifcate into the keystore. I tried copying the CACerts file from the cf9 instal, as well as start fresh and manually import the certs.

1
coldfusionauthorize.netcfhttp
My best guess is that the TLS 1.2 feature is disabled by default in Windows Server 2008. You can enable it cloudblogs.microsoft.com/microsoftsecure/2017/07/20/… - rrk
Before trying to do that try to add -Dhttps.protocols=TLSv1.1,TLSv1.2 this to jvm config in ColdFusion Administrator and restart CF and see if that fixes it.. - rrk
ColdFusion 2016 on Java 1.8 does TLS 1.2 communications via CFHTTP by default. You should not have any special tricks to get it working. Adding the Https.protocols to the jvm.config will not increase the TLS support level, but you can forcibly disable. - WilGeno

1 Answers

3
votes

It's likely to be related to the disablement of TLS 1.0 and 1.1 which happened today.

We're having the same issue on a couple of servers, but not others, so trying to work out why that is.

All servers are TLS 1.2 enabled, but connections on some appear to be failing.