portal entry

There can be many explanations for what's amiss, but I will offer two that are rather common for ssl-related issues in CF, and then close with a couple other possibilities. <strong>First</strong>, you say you imported a cert using keytool. Ok, but let's talk about WHERE you put that cert. Note that you need to put it in the /lib/security/cacerts of wherever cf is naming its jvm to be. And that may not be the jre folder under the cf folder, though many resources show (including from Adobe) will presume to show using the keytool to put a cert there. The thing is, if someone may have changed cf since installation to use a new jvm, then your cf admin jvm page will show it pointing elsewhere, and you need to import the cert into the /lib/security/cacerts of THAT folder instead. And when you may change jvm’s in the future, don’t forget to bring the certs along, though only if still needed. See my next point. <strong>Second</strong> and speaking of changing the jvm, somemes such a cert import is NOT needed after all, to fix ssl-related problems. You may simply need to update the jvm that cf is using. For more, see my post: <a href="https://coldfusion.adobe.com/2019/06/error-calling-cf-via-https-solved-updating-jvm/">https://coldfusion.adobe.com/2019/06/error-calling-cf-via-https-solved-updating-jvm/</a> Indeed, some folks have been importing certs over and over as they DID move to new jvm’s (see above) when in fact the cert was no longer really needed. Hope that’s helpful. Let us know if you resolve things or not. If not, then consider finally the possibility of conflicts on that port 587 either from a firewall or anti-virus tool. And then do clarify whether those messages above were all from when things were configured one way or another. If from when configured one way, are they different when things are configured another?

Comment by Charlie Arehart

Charlie, thanks for your comments!  I have finally run though all of the possibilities and it may be conflicts with the firewall or virus tool.  At this time, we have given up trying to chase it down.  We have enabled TLS to the mail server on port 25 and that is what we will go with for now.

Comment by rcasdorph