topic Re: TLS 1.2 Issue with Cold Fusion 10 in Integration and Testing

TLS 1.2 Issue with Cold Fusion 10

TomS — Thu, 01 Mar 2018 15:15:14 GMT

Hello,

Our store stopped processing payments yesterday, February 28.
Our host says TLS 1.2 is enabled.
Our site is a Cold Fusion 10 site and has connected to Authorize.net for years with no issues with the following:

<cfhttp url="https://secure2.authorize.net/gateway/transact.dll" method="post">
   <cfhttpparam type="FormField" name="x_Login" value="#var.AuthNetLogin#">
   <cfhttpparam type="FormField" name="x_Password" value="#var.AuthNetPassword#">
   <cfhttpparam type="FormField" name="x_version" value="True">
   <cfhttpparam type="FormField" name="x_type" value="AUTH_CAPTURE">
   <cfhttpparam type="FormField" name="x_Amount" value="#NumberFormat(Client.OrderTotal,'999999999.99')#">
   <cfhttpparam type="FormField" name="x_Card_Num" value="#request.CCNumber#">
   <cfhttpparam type="FormField" name="x_Exp_Date" value="#NumberFormat(request.CCExprDate,'0999')#">
   <cfhttpparam type="FormField" name="x_card_code" value="#request.CVC#">
   <cfhttpparam type="FormField" name="x_Last_Name" value="#rsGetCustBilling.cst_LastName#">
   <cfhttpparam type="FormField" name="x_First_Name" value="#rsGetCustBilling.cst_FirstName#">
   <cfhttpparam type="FormField" name="x_company" value="NA">
   <cfhttpparam type="FormField" name="x_Address" value="#rsGetCustBilling.cst_Address1#">
   <cfhttpparam type="FormField" name="x_City" value="#rsGetCustBilling.cst_City#">
   <cfhttpparam type="FormField" name="x_State" value="#rsGetCustBilling.stprv_Name#">
   <cfhttpparam type="FormField" name="x_Zip" value="#rsGetCustBilling.cst_Zip#">
   <cfhttpparam type="FormField" name="x_Country" value="#rsGetCustBilling.country_Code#">
   <cfhttpparam type="FormField" name="x_Phone" value="#rsGetCustBilling.cst_Phone#">
   <cfhttpparam type="FormField" name="x_email" value="#rsGetCustBilling.cst_Email#">
   <cfhttpparam type="FormField" name="x_customer_ip" value="#cgi.remote_addr#">
   <cfhttpparam type="FormField" name="x_Method" value="CC">
   <cfhttpparam type="FormField" name="x_ADC_Delim_Character" value=",">
   <cfhttpparam type="FormField" name="x_ADC_Delim_Data" value="TRUE">
   <cfhttpparam type="FormField" name="x_ADC_Encapsulate_Character" value="">
   <cfhttpparam type="FormField" name="x_ADC_URL" value="FALSE">
   <cfhttpparam type="FormField" name="x_Test_Request" value="FALSE">
</cfhttp>

<cfset request.TransactionResult = Val(ListFirst(cfhttp.fileContent))>
<cfset request.TransactionID = ListGetAt(cfhttp.fileContent, '7')>
<cfset request.TransactionMessage = ListGetAt(cfhttp.fileContent, '4')>

Cold Fusion now throws this error:
Invalid list index 7. In function ListGetAt(list, index [, delimiters]), the value of index, 7, is not a valid as the first argument (this list has 1 elements). Valid indexes are in the range 1 through the number of elements in the list.

Any help/direction would be sincerely appreciated.

Re: TLS 1.2 Issue with Cold Fusion 10

JoelVogt — Thu, 01 Mar 2018 15:23:16 GMT

I'm getting the same issue with ColdFusion 11. Everything works on the test server, but when we process with the live server, we get the exact same error.

You're getting this error because what's being returned in the cfhttp.fileContent is simply "Connection Failed" and you can't do a ListGetAt because there's no list.

If you put in:

right after the </cfhttp> it'll show you what is actually being returned from Authorize.net.

As for the connection issue that's failing, I'm in the same boat as you are. One interesting thing, we did have ONE transaction go through last night. But everything else has failed.

Re: TLS 1.2 Issue with Cold Fusion 10

TomS — Thu, 01 Mar 2018 16:02:50 GMT

Thanks for the reply Joel.
You're absolutely correct. CFDump resulted in Connection Failure.
It was long day and night yesterday and today looks to be a repeat.
Thanks again.

Re: TLS 1.2 Issue with Cold Fusion 10

JoelVogt — Thu, 01 Mar 2018 16:19:13 GMT

Tom, I just updated our server with the latest version of Java 1.8.0_161 and it's now working again!

Just make sure that when you download it that you get the correct type (32 or 64 bit) for your ColdFusion install. As you can guess, I got the wrong one initially and I figured I'd save you a little of the additional panic I went through :)

Good luck and I hope this fixes it!!!

Re: TLS 1.2 Issue with Cold Fusion 10

TomS — Thu, 01 Mar 2018 16:28:51 GMT

Thank God!
That is out of my control so I've forwarded that info to my host.

Thank you.

Re: TLS 1.2 Issue with Cold Fusion 10

JoelVogt — Thu, 01 Mar 2018 16:33:53 GMT

You're welcome! I hope they can get to it quickly and it fixes your problems.

Re: TLS 1.2 Issue with Cold Fusion 10

wilgeno — Fri, 02 Mar 2018 17:09:17 GMT

As others have pointed out you should to be running on Java 1.8 to get TLS 1.2 with ColdFusion 10 and up. However, with ColdFusion 10 if you have update 18 installed you can get TLS 1.2 by adding JVM arguments to your jvm.config and get full TLS 1.2 support with Java 1.7. But I will point out that Java 1.7 is long past end of life and you really should be on Java 1.8.

I'm with CF Webtools and we have been doing a lot server updates for companies that need their ColdFusion server patched or Java updated. Also, for older versions of ColdFusion such and ColdFusion 9 or even 8, (you really should upgrade! https://www.trunkful.com/index.cfm/2018/1/31/TLS12-for-ColdFusion-9-and-Older ) we've been helping companies get past the hurdles there as best as we can. In some cases we've been able to get the ColdFusion 9 working with TLS 1.2.

Regards,

Wil

Re: TLS 1.2 Issue with Cold Fusion 10

Sprovost — Mon, 14 May 2018 14:35:27 GMT

Had two stressful weeks trying to solve my issue with Authorize.net. My shopping cart worked perfectly via their Sandbox, but not when live thru my website.

Final solution: make sure your site's URL's are all www or not www. That was the first problem. Second problem (that probably set the problem in action), was that i had just loaded an htacess file on the site that rewrite all pages to be https. Previously only the shopping cart checkout was https and the rest of the site was http. That rewrite was the major problem. Fixed these two items and all it well!

Re: TLS 1.2 Issue with Cold Fusion 10

joshuanathanson — Sat, 09 Jun 2018 21:23:32 GMT

Hi All,

I had upgraded my Java to 1.8 a couple of months ago and things were running smoothly. Now for some reason, I'm getting "Connection failure" again. Not sure why it would suddenly stop working again. Did anything happen over the last couple of weeks?