title: Coldfusion CFHTTP handshake_failure
body: <p>I am trying to send a SOAP request by CFHTTP with a client certificate. My test requests in SOAP UI are successful but when I try to send requests by CFHTTP I get the following error:</p>
  
  <pre><code>I/O Exception: Received fatal alert: handshake_failure
  </code></pre>
  
  <p>My CFHTTP tag is like this:</p>
  
  <pre><code>&lt;cfhttp
      url="https://..."
      method="post"
      clientcert="C:\..."
      clientcertpassword="password"
      result="httpResponse"
      &gt;
  </code></pre>
  
  <p>I have tried to check the logs for more ideas of where the failure could be happening. I can only get the following:</p>
  
  <p>http.log</p>
  
  <pre><code>"Information","ajp-bio-8014-exec-10","09/26/16","07:07:59",,"Starting HTTP request {URL='https://...', method='post'}"
  </code></pre>
  
  <p>coldfusion-out.log</p>
  
  <pre><code>Sep 26, 2016 07:07:59 AM Information [ajp-bio-8014-exec-10] - Starting HTTP request {URL='https://...', method='post'}
  </code></pre>
  
  <p>I have imported the certificates with keytool and when I list the certificates in cacerts I see them there.</p>
  
  <p>Any other ideas where I can look to troubleshoot this issue?</p>
  
  <p>Edited to add:</p>
  
  <p>My certificate is in .p12 format and has a password. I have tested the .p12 file with the password in SOAP UI and it works.</p>
  
  <p>I have installed CF10-Certman and confirmed the certificates are there from CF Administrator as well.</p>
  
  <p>I've added these lines to my jvm.config:</p>
  
  <pre><code>-Djavax.net.ssl.keyStore=C:\\ColdFusion11\\jre\\lib\\security\\cacerts 
  -Djavax.net.ssl.keyStorePassword=password 
  -Djavax.net.ssl=debug
  -Djavax.net.debug=all
  </code></pre>
  
  <p>I tried the keystore path with \ and / ("C:/Coldfusion11/...")</p>
  
  <p>Additional coldfusion-out.log output:</p>
  
  <pre><code>Sep 26, 2016 11:10:06 AM Information [ajp-bio-8014-exec-2] - Starting HTTP request {URL='https://...', method='post'}
  ...
  Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  ...
  Allow unsafe renegotiation: true
  Allow legacy hello messages: true
  Is initial handshake: true
  Is secure renegotiation: false
  %% No cached client session
  *** ClientHello, TLSv1
  RandomCookie:  GMT: 1458128991 bytes = { 40, ... }
  Session ID:  {}
  Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
  Compression Methods:  { 0 }
  Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
  Extension ec_point_formats, formats: [uncompressed]
  Extension server_name, server_name: [host_name: url ]
  ***
  ajp-bio-8014-exec-2, WRITE: TLSv1 Handshake, length = 195
  ajp-bio-8014-exec-2, READ: TLSv1.1 Alert, length = 2
  ajp-bio-8014-exec-2, RECV TLSv1 ALERT:  fatal, handshake_failure
  ajp-bio-8014-exec-2, called closeSocket()
  ajp-bio-8014-exec-2, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
  Finalizer, called close()
  Finalizer, called closeInternal(true)
  </code></pre>
  
  <p>The CipherSuite in SOAPUI is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</p>
  
  <p>UPDATE</p>
  
  <p>I removed the clientcert and clientcertpassword from the cfhttp tag and now I am seeing this in coldfusion-out.log:</p>
  
  <pre><code>ajp-bio-8014-exec-1, WRITE: TLSv1.1 Handshake, length = 64
  ajp-bio-8014-exec-1, setSoTimeout(360000) called
  ajp-bio-8014-exec-1, WRITE: TLSv1.1 Application Data, length = 1680
  ajp-bio-8014-exec-1, READ: TLSv1.1 Alert, length = 48
  ajp-bio-8014-exec-1, RECV TLSv1.1 ALERT:  warning, close_notify
  ajp-bio-8014-exec-1, called closeInternal(false)
  ajp-bio-8014-exec-1, SEND TLSv1.1 ALERT:  warning, description = close_notify
  ajp-bio-8014-exec-1, WRITE: TLSv1.1 Alert, length = 48
  ajp-bio-8014-exec-1, called closeSocket(false)
  ajp-bio-8014-exec-1, called close()
  ajp-bio-8014-exec-1, called closeInternal(true)
  </code></pre>
  
  <p>I have reached out to the server administrator to see if they are seeing the request on their end.</p>
  
  <p>UPDATE</p>
  
  <p>Adding the clientcert back in fixed it!</p>