No SSL With ColdFusion's CFPOP?
I was very surprised to find out that ColdFusion's CFPOP tag does not support POP3 SSL. ColdFusion is over 10 years old now...you've got to add that in, Adobe!
Anyway, I did some digging around, and thanks to a comment on another blog by Darin Tyler, I found an easy fix. You can use some simple Java commands to "force" cfpop to use SSL. In my testing, I used Gmail, and the code is below:
<cfset javaSystem = createObject("java", "java.lang.System") />
<cfset javaSystemProps = javaSystem.getProperties() />
<cfset javaSystemProps.setProperty("mail.pop3.socketFactory.class", "javax.net.ssl.SSLSocketFactory") />
<cfpop
server="pop.gmail.com"
action="getAll"
name="popMessages"
port="995"
username="myemailaddress@gmail.com"
password="i'mnotgoingtotellyou">
<cfset javaSystemProps = javaSystem.getProperties() />
<cfset javaSystemProps.setProperty("mail.pop3.socketFactory.class", "javax.net.ssl.SSLSocketFactory") />
<cfpop
server="pop.gmail.com"
action="getAll"
name="popMessages"
port="995"
username="myemailaddress@gmail.com"
password="i'mnotgoingtotellyou">
Jake Munson
35 Yrs old
The Java call is the way to go, and I wanted to share one additional technique I've used with it: you'll want to turn SSL off if the user turns it off to access another POP account, or if the same application serves multiple users who don't all use SSL. So after you turn SSL on with the line:
<cfset javaSystemProps.setProperty("mail.pop3.socketFactory.class", "javax.net.ssl.SSLSocketFactory") />
You can turn it off with:
<cfset javaSystemProps.setProperty("mail.pop3.socketFactory.class", "javax.net.SocketFactory") />
I'm actually trying this out but coming up with a few issues. Just tried writing a sample block that will connect to gmail but the server is returning
An exception occurred when setting up mail server parameters.
This exception was caused by: javax.mail.MessagingException: Connect failed; nested exception is: javax.net.ssl.SSLException: untrusted server cert chain.
I'm guessing since the SSL cert was not explicitly accepted, the security sandbox blocks this. Any workaround for this ?
The codes are:
<CFTRY>
<CFSET javaSystem = createObject("java", "java.lang.System") />
<CFSET javaSystemProps = javaSystem.getProperties() />
<CFSET javaSystemProps.setProperty("mail.pop3.socketFactory.class", "javax.net.ssl.SSLSocketFactory") />
<CFPOP name = "rsCheckNew" action = "getHeaderOnly"
server = "pop.gmail.com" port = "995" timeout = "10"
username = "myusername" password = "mypassword">
<CFCATCH type="any">
<CFSET msg = "Error Checking POP3 Account.">
</CFCATCH>
</CFTRY>
I can't see a difference between your code and the code I put in my blog entry. Not sure what's going on, unless Google changed things on their end. I wrote this a few months ago and haven't tried this code since, so maybe Google doesn't allow this anymore?