ColdFusion Muse

ColdFusion and Java 8 and Java 11 Updates

Wil Genovese March 8, 2019 4:29 PM Java, ColdFusion, Coldfusion Security, Security Comments (3)

As many of you are aware Oracle has changed their licensing for Java 1.8 and making it a pay to play for all commercial purposes. Here's a link to the licensing announcement. I'm not a lawyer and I'm not going to pretend that I understand these licensing agreements. But Oracle and Adobe (or their lawyers I presume) do understand these and as such there are changes to note. On January 24th Adobe announced that Adobe will maintain support. via a Long-Term Support Agreement with Oracle, for Java 8 and Java 11. Thank you Adobe!

I have questions as I'm sure everyone else does. I've been asking representatives at Adobe these questions.

What does this mean for us?
ColdFusion Server runs on Java from Oracle, and as such the new Oracle license affects all of our ColdFusion servers. To this point Adobe has secured licensing from Oracle that allows all ColdFusion Server owners continue running Java. It is very important to note that you now need to download Java from Adobe and NOT Oracle. Get your Adobe Licensed Oracle Java downloads HERE!

Is the Java version from Adobe Different that the same version from Oracle?
Great Question and I asked Adobe about this. Here is the answer "Wil, installers are same but license attached to them are different and this is for both Java 8 and 11".

What about my existing ColdFusion Servers?
Another great question! There are tens of thousands (or more) ColdFusion servers running and the vast majority of them are running on Java from Oracle. I know that the CF Webtools Operations Group maintains a very large number of servers for a large number of clients. Over time we have been upgrading the Java version on the servers to keep up with the security updates from Oracle. This means that most if not all of these servers are on Oracle Java from Oracle and not from Adobe. What do we have to do to remain compliant? I really hope we do not have to visit all of these servers and replace the Java with the one from Adobe simply because there is a different license agreement attached. I have submitted this question to Adobe and I'm awaiting anxiously for the answer. What I do know is that all servers that we need to update are going to get the Adobe Licensed version of Oracle Java to stay safe.

I received an answer today from Adobe on this.

Wil, to answer your question, if the JDK/JRE were downloaded before Oracle came up with Licensing change, it should not be an issue. Otherwise we recommend using the Adobe provided download as soon as possible, although we don't see a deadline around this.
This means that all the servers that I have recently updated will need to be re-updated with the Java from Adobe that has a different license agreement.

What about my New ColdFusion Servers?
This question has a simple answer. To install a new ColdFusion Server you need to use the ColdFusion installer from Adobe which comes with an Adobe licensed version of Oracle Java. If you want to use a newer version of Oracle Java then you need to download the Adobe Licensed vision of Oracle Java from Adobe. Download Here!

Do I have to use Oracle Java?
Awesome question and the answer is yes, no, maybe. There is OpenJDK that may work just fine to run ColdFusion servers. There is also a new player in the Java game and that is Amazon. "Amazon Corretto is a no-cost, multiplatform, production-ready distribution of the Open Java Development Kit (OpenJDK)." Currently their version 8 is production ready and they version 11 is in the Release Candidate stage. I have run ColdFusion 11 an dColdFusion 2016 on Amazon Corretto 8 and it ran fine for the very limited testing that I did. For now there isn't official support from Adobe for these two Java versions.

As I get more information from Adobe I will provide updates above. I'm sure there will be more questions that people will want answered.

CF Webtools Developer Teams are ColdFusion experts and are ready to build your applications. We are also an Amazon Partner. Our Operations Group can build, manage, and maintain your AWS services including ColdFusion servers. We also handle migration of physical servers into AWS Cloud services. If you are looking for professional AWS management our operations group is standing by 24/7 - give us a call at 402-408-3733, or send a note to operations at CF Webtools .

  • Share:


  • Eric J Belair's Gravatar
    Posted By
    Eric J Belair | 4/17/19 10:49 AM
    I noticed that Oracle released a new update for Java 8 (Update 211) yesterday, yet, this version is not yet available on the Adobe downloads page. Can we expect Adobe to keep pace with offering the up-to-date downloads?
  • Mark Kruger's Gravatar
    Posted By
    Mark Kruger | 4/17/19 10:57 AM

    It's a good question. I'll see if we can get an answer for you. I suspect the answer is yes. I'm betting they get notice well in advance of a new release. But testing minor updates for your product may not always keep pace with exact release dates.

    I'll see what they say.

  • Hakan's Gravatar
    Posted By
    Hakan | 7/29/19 7:21 AM
    We are using ColdFusion 9.0.1 with jdk 1.7.0_75 version. We have to use TLS 1.2 in our systems.

    We have tried:
    -   Added -Dhttps.protocols=TLSv1.2 line to JRun4 > bin > jmv.config file.
    -   Installed jdk1.8.0_172 - jdk1.8.0_221 versions and changed JRun4 > bin > jmv.config > java.home path. After that when i want to open web page, opens empty page. It is empty between body tags. There is no error. I have read an article linked below, i can use ColdFusion 9 with Java 8 without problem.

    Here is the Stackoverflow link:

    Infact, question is simple.

    How can we use ColdFusion 9 with TLS 1.2.

    My OS Windows 2008 Server R2, running on Vmware and JRE 8 installed already.

    Thanks for you replies.