Use cfmail with SSL authentication

More and more mail servers requires SSL authentication to send emails. Usually you send mail like

<cfmail server="" usessl="true" port="465" ...> 

You may need to add a mail server certificate into Lucee JRE environment to avoid connection errors like this one:

PKIX path building failed: unable to find valid certification path to requested target 

  • Add certificate to Lucee itself. Go to Lucee Server Administrator -> Services -> SSL certificates
Host: - for example
  • Fetch and Install certificate into JRE environment (path to Lucee JRE, for example /opt/lucee/jdk/) fetch on Linux:
openssl s_client -connect < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /opt/smtp-mail-public.crt

fetch on Windows (or get certificate and save to local file without command line):

openssl s_client -connect < NUL | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > C:/smtp-mail-public.crt

Now we have a certificate file. Install with a JRE keytool:

/opt/lucee/jdk/jre/bin/keytool -import -alias -keystore /opt/lucee/jdk/jre/lib/security/cacerts -file 	/opt/smtp-mail-public.crt

The default prompted password for keystore is changeit

  • Restart Lucee to apply changes. <cfmail server="" usessl="true" port="465" ...> should work now.

Do not forget to repeat steps 2) and 3) if you decide to upgrade JRE version by replacing JRE folder.

See also