portal entry

ColdFusion 9 is out of support. Has been for two years. It's actively dangerous to have deployed, doubly so if you are processing user data!

Comment by Tom Chiverton

Hey, I cannot tell you if 9.0.1 and Java 8 have issues, but I figure there are posts out there talking about that...you just need to look...check out these forums and see. Now, how to test if you can update your code to cf11, 2016, or 2018...use commandBox. Check out the commandbox docs for instructions on how to spin it up. when you go to the commandbox site, download the commandbox zip file for windows (or whatever it is for mac). When you download it, unzip it and put it somewhere, say c:/commandbox. Then double click the the box.exe to install it and start commandbox. Note: commandbox will install itself in your user folder...if you need to find it to look at your servers. Now, in the commandbox command window, cd into your codebase. Then type the following...box server start cfengine=adobe@11 or @2016 or @2018 but you need to verify the syntax via the docs. This will take some time to spin up a coldfusion server (it is an exploded war file in the user directory)...when it finally installs it will open up a default browser with the front of your application. Then you look in your trey near the clock and you will see a cf icon...click on that to open cfadmin. Then you can configure you cfadmin. By using commandbox, you can spin up multiple servers and test how your code will work on all of them. This will give you a better answer on how your code will work on newer cf versions.

Comment by daniel fredericks

While Tom is certainly right, I would say to Mahern that what you may be experiencing is that while you THINK that Java was updated, perhaps it was not. There are many things that can go amiss. If you look at the CF Admin "settings summary" (last option in the first section on the left), does it report that the java version is indeed 8? If not, then you made some mistake. More than that, people often make mistakes that can lead CF to report that correct version but still not be implemented quite right. All that said, CF9 was never updated (by Adobe) to support Java 8. Some have found it did work and solved their problems, especially like yours calling remote services via cfhttp with https. Finally, you asked how to test your CF9 code for CF11 compatibility. To do that, implement CF11 on some machine (using the free trial or Developer edition, and run the Compatibility Analyzer feature also in the CF admin), where you could select CF9 and CF10 as the versions against which the analysis should be done, to identify issues that the tool can report. Note that you could install CF11 even on the same box as CF9, if you are careful, but it would be safer to install it on some other machine. If you DO proceed to install CF11 on the same machine where CF9 runs, just be sure NOT to integrate CF with your web server (IIS or Apache), so that your production is not impacted while you are testing. Note finally that the web server integration setup on CF9 and earlier is quite different than CF10 and above, which is another significant challenge for many in trying to move from 9 or earlier to 10 or later on the same machine. While all these things are challenging, they are not impossible. Again, as Tom says, there are MANY important security reasons to NOT run anything earlier than CF11 (which Adobe will publicly support into mid-2019). But I've been helping people solve the issues above on different CF versions for over a decade, so I know they usually can be solved.

Comment by Charlie Arehart

ColdFusion 9.0.n will not handle TLS 1.2 when running on Java 1.7 and older. ColdFusion 9.0.n is NOT certified to work on Java 1.8 and there are known issues on Java 1.8. Additionally the Operating system plays a role here as well. Windows Server 2003 will NEVER handle TLS 1.2. End of story. Windows 2008 Standard finally has an update that will allow TLS 1.2. However, combined with CF9.0.n on Java 1.7 you still will not achieve TLS 1.2 communications. You'll need ColdFusion 10 or newer. Windows Server 2008 R2 is fully ready for TLS 1.2 and you can add in the custom tag CFX_HTTP5 to handle TLS 1.2 communications with ColdFusion 9.0.1 on Java 1.7.  See my article here for details. https://www.trunkful.com/index.cfm/2018/1/31/TLS12-for-ColdFusion-9-and-Older

Comment by Wil Genovese