ColdFusion 9 Reaches End Of Life, Long Live ColdFusion!

NO MORE COLDFUSION 9.0.n SECURITY PATCHES/UPDATES BY ADOBE, AS "CORE SUPPORT" ENDS DECEMBER 31, 2014.

It has been a long known fact that for the ColdFusion 9 series, End of Core Support was coming. Here is the Adobe Support Matrix. According to this article at Adobe's Support Lifecycle Policy this is what Core Support means.

Core Enterprise Maintenance and Support Programs
The existing Platinum Maintenance and Support and legacy Standard Support, Premium Maintenance and Support programs will now provide five years of product support from the general availability date of a product, starting with the release of a ".0" product version (a "root release"). Support for all derivatives -- localized versions, minor upgrades, additional operating systems, etc. -- of a root release terminates with support for the root release. This includes dot and double-dot releases and connector products.
The essence of this is that Adobe will no longer provide updates for the ColdFusion 9 series. Any new bugs or security issues will remain unresolved.

Adobe will still offer "Extended Maintenance and Support" via their Platinum Maintenance and Support services.

Extended Maintenance and Support
This new program option gives your organization an additional two years of Platinum Maintenance and Support services after the five years provided. Extended Maintenance and Support provides your organization the valuable extra time you may need to plan your migration to Adobe's latest technology.

So this is yet another case for upgrading.

Please consider upgrading to a newer version of ColdFusion!

ColdFusion JVM, SSL CA CERTS and POODLE

We ran into this when a company contacted us at CF Webtools with the problem of ColdFusion was suddenly no longer able to connect to their email providers mail servers. The complaint was that ColdFusion was sending emails to their clients just fine the day before but today it can't. These issues are usually best resolved by asking "What changed?". As far as the client knew, nothing had changed.

After doing some investigations on the server we deeded to do some very simple testing. Does it connect to any mail server? Yes, it connected to our mail server without TLS just fine. But it would not with TLS. That's the big clue! I also noted they were on JVM 1.7.0_15 which I know is about two years old. During this time there have been mandated changes to SSL encryption levels to stronger encryption. If the CA Root Certificates on your system are old they may/will not work with new SSL Certs that use the stronger encryption. We upgraded the JVM version 1.7.0_67 and the problems were resolved. ColdFusion was once again send email through their email providers mail server over a secure connection.

So what happened?

[More]