[Looking for Charlie's main web site?]

CF911: Why/when you MUST update the web server connector for ColdFusion 10/11 and may have missed it

Note: This blog post is from 2013. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.
Have you installed or updated CF10 (or 11) and found that you still have problems with it running right, even when you have "fully updated" CF10? In this blog entry, I explain how it may NOT be that "CF 10 is broken" but rather that you may have missed an important step when updating it.

In brief, a VERY common problem is that while they MAY WELL have applied the provided "updates" for CF, folks often do NOT notice that they may have to (and generally must) "update" the web server "connector" (if they are using an external web server, like IIS or Apache) as a separate manual step, after applying the update.

I explain here what that means, how do to it, and why you may miss that you need to.

Update in 2019:

Since writing this entry, I did one in 2019 on When and how to upgrade CF web server connector, easier since CF2016, which at least makes it EASIER to upgrade, though much of what I write here still applies. I also updated this post since originally writing it, in ways discussed below.

(Or if you'd rather just have me help you quickly help you analyze and rectify your situation, whether with regard to the connectors or any other CF server troubleshooting, I can do that in a brief consulting session, likely less than an hour, remotely and securely. I provide all the detail here for those who prefer to "go it on their own". For more on my consulting services, including rates, approach, satisfaction guarantee, and more, see the consulting page at carehart.org.)

Sections below

Here's an outline of the sections below:

  • The least you need to know
  • So what is it to reconfigure/rebuild/update the connector?
  • What's the situation with CF10 updates and the need to update the connector?
  • About those numbered folders
  • Should I back things up first?
  • How to reconfigure (or rebuild) the connector
  • Don't forget to "Run as Administrator"!
  • Reconfiguring/rebuilding the Connector if you have multiple instances
  • How can I know whether a given update DID offer an updated connector?
  • You *may* only need to do an "upgrade" rather than a "reconfigure/rebuild" of the connector
  • Where can I learn more about all this?

BTW, some use the phrase "reconfigure", "rebuild", and "update" of the connectors rather interchangeably. I do the same here, in case people come searching for either phrase. (Note: I'll mention later how there is in fact a difference between "reconfiguring/rebuilding/updating" the connector and a separate possible option to just "upgrade" the connector. It's quite different, but not always the right option to use. I discuss that below as well.)

[Update While I wrote this in 2013 for CF10, the same applies to CF11 and some of its updates, which also call for a rebuild of the web server connector. It's about 50% of the updates that to each that DO require a connector rebuild afterwards.

And here's great news for those on CF2016: this whole issue has finally has been addressed and the update mechanism DOES now properly update the web server connector for you, if needed. So all the below applies only to those still on CF10 or 11.]

I'll also explain how to easily tell if you have done the update or not, so you know whether all this applies to you. I'm betting it does.

Indeed, getting the web server connector updated is the solution to a majority of problems I see people have, when they feel that problems are tied solely to a recent move to ColdFusion 10 or 11.

Read on to learn much more about this issue of web server connector updating.

[Updates since Sep 2013:
1) Since writing this entry, I did a subsequent one on Still more reasons to make sure you have updated your ColdFusion web server connector, so be sure to read that next.

2) Also, someone asked in the comments if this problem (reported by me here in Sept 2013) still remains for newly downloaded CF10 or 11 installation files. Sadly, it absolutely does. While a new install includes whatever updates are current at that time, the installer may not then be updated again for months, so by the time you get it, it may not be several updates out of date. This is not a new problem.

Bottom line: YES, if you download CF10/11 to install it, you MUST do the following: a) downloading CF, b) apply whatever is the latest available update at that time, and c) update the connector, as discussed below.

3) Finally, one more update I want to slip in since writing this entry in 2013: do beware that one negative of rebuilding the connector (as described below, and for the important reasons discussed) is that you will lose any setting changes you may have made regarding the connector (such as to the workers.properties or uriworkermap.properties. These are discussed in the Adobe blog entries on tuning the connector, like this one for cf11 and this one for cf10.) Some good news is this problem was addressed somewhat in CF11, as of update 5. The connector tool (in CF11 only) at least now prompts you to backup your current connector files. It does NOT restore them, so that's still up to you to do. Either way, do be careful to save any such changes before rebuilding the connector as described below. ]

The least you need to know.

For those who wish I could "cut to the chase" (though it risks leaving a lot unsaid), here's the least you need to know, to determine if this is need to update your connector may be an issue for you: look in each "numbered" folder under [cf10]\config\wsconfig. In there, you will have a connector module, either isapi_redirect.dll for IIS or mod_jk.so for Apache.

If you're on Windows and that isapi_redirect.dll file is dated many months ago, then you have likely not updated the web server connector. For instance, If you've applied CF10 update 11 (latest as I write this) and are on IIS, and the DLL file is not dated May 2013 or later, then you have NOT reconfigured/rebuilt the connector and could have problems due to that. And if you're on CF10 and your DLL is dated March 2012, then you have not updated the connector AT ALL since CF10 cam out, and you can expect serious problems under even moderate load.

As for Apache, I'm not positive of which updates required an update but I know some did, so again, if you're on CF10 and that mod_jk.so is dated March 2012, then you have not updated it at all, which is really bad. If it's many months old, it may still not be as updated as it could be.

Do note that reconfiguring (or rebuilding) the connector does indeed involve more than just its updating that one .dll file (or the .so file in Linux), but includes its also updating other files within CF and also it updating appropriate files and configuration information in IIS or Apache. I'm merely saying that looking at that date of that connector module file is a quick check of whether you've done the reconfigure (or rebuild) of the connector at all.

So what is it to reconfigure/rebuild/update the connector?

I'll detail this more below, but in brief, as for reconfiguring/rebuilding/updating the connector, here's what is meant: opening the CF web server configuration tool (wsconfig tool), and "removing" whatever connections you may show existing for your given site/sites, then adding them back.

Under the covers, this process will remove and then re-add certain files/folders in the [coldfusion\config folder, and it will update your web server config files (including removing then re-adding the CFIDE and jakarta virtual directories in whatever site/sites you connect to. Do beware that if you or anyone else may have removed the CFIDE virtual directory from some sites in your web server config, you may want to go back and remove it again once completed.)

If you have only one connector listed there, you're done.

If you have multiple connectors, you would remove and re-add each of those. (If you have more than one, you should take note of what sites are listed so you can add them back appropriately. And I discuss below about backing up changes before proceeeding.)

If you may be running multiple instances of ColdFusion (meaning you're using CF Enterprise/Trial/Developer and you created multiple instances in the CF Admin Instance Manager), then you would need a different connector for each instance. While you can remove connectors for any instance in the tool, you will find that when you try to add back a connection, it does NOT offer a list of instance names in the dropdown. Instead, you have to open the wsconfig tool inside each instance's folders, at [cf10]\[instance]\runtime\bin. (Again, more on this later. Again, this section is "the least you need to know".)

Now, let's proceed with the rest of the info I think you ought to understand about this whole issue, which I've not seen pulled into any one place.

What's the situation with CF10 updates and the need to update the connector?

As most will know, since ColdFusion 10 came out in May 2012, there have been 11 "updates" (as of this writing). That's great that problems are being fixed. The bad news is that many people THINK that they have "fully updated CF10" by applying the latest update, when they may still NOT have "fully updated" their ColdFusion 10 implementation.

In each update, there is a "more info" link on the page for the update, shown in the "Server Update" tool of the CF Administrator, and in the technote it states whether after applying the update you may (and generally must) rebuild/reconfigure or at least "upgrade" the web server connector. The issue is that sometimes the updates include a fix to the connector (mod_jk.so for Apache, isapi_redirect.dll for IIS).

As I said above, if that connector file (as found in in each "numbered" folder under [cf10]\config\wsconfig) is still dated March 2012, then you have not updated the connector and can expect serious problems under even moderate load. And if it's more than a few months old, you probably have not updated the connector, as most CF10/11 updates do involve tweaks to that connector, requiring it to be reconfigured by you.

(Yes, yes, I know that the whole point of the CF10 auto hotfix mechanism was that it was supposed to be a single click update. In this case, it just seems that the updaters are not able to do the web server configuration updates. Since folks can have different web site configurations, I think I can understand Adobe not feeling they could step in and handle this for you. Still, it surely has left many in a situation where they are suffering needlessly for having missed this important step. Update: again, some great news is that in CF2016 this finally has been addressed and the update mechanism DOES now update the connector if needed.)

About those numbered folders

There is one "numbered" folder under the wsconfig folder, representing each connection made between an external web server and CF. if you configured the connector for "all sites" and nothing else, there should be just one folder, numbered "1". As you connect other sites to CF, whether to the one "cfusion" instance or to different instances you may have installed if on CF10 Enterprise, you will get another numbered folder.

BTW, sometimes people find when looking here that they do have multiple numbered folders, even though they have only one connector. That's ok if you DO really have multiple connectors listed in the wsconfig tool. If indeed you have only one instance and it's listed in the wsconfig tool as being connected to "all sites", then having more than one folder would be an indication of a mistake/problem (most typically that you failed to run the wsconfig tool "as administrator" on Windows. More below).

If you have multiple instances, again, you may have more numbered folders because you have connections between sites and instances.

There can be other situations where you have more numbered folders than you should and things ought to be cleaned up. This is not the blog entry to elaborate on that. If you think you have a problem, and want to solve it, contact me about my consulting services and I'd be happy to help, hopefully quite quickly since I have helped many others.

Should I back things up first?

Given all the above, and before you may proceed with the steps below, you would be wise to backup the key files that would be changed in a connector update. (Again, as an update since writing this in 2013, in 2014 CF11 came out and it DOES now offer to backup the settings before changing them, if you try to remove a connector.)

I have mentioned that the update (remove/re-add) will first remove and then re-add key files in the [coldfusion]\config folder (and its underlying numbered subfolders). You should consider simply making a backup of the entire config folder (it's usually not very big at all), so that you could either review what changed or recover if there's a problem. (I've also mentioned that CF11 update 5 now does offer to backup the connector files when removing a given connector: it saves the related numbered folder for that connector in a new backups folder within the wsconfig folder.)

I've also mentioned that the connector update will also remove and then re-add key configuration entries in your web server configuration, particularly the CFIDE and Jakarta virtual directories. But it will also modify other things (the "isapi filters" and "handler mappings" configuration in IIS, and similar settings in your Apache conf files).

It would be wise to back those up as well before proceeding. In the case of Windows, it's a bit challenging because you may have such web site configuration values in either the web.config of your web site(s) or (more likely) in the applicationhost.config file (in Windows\system32\inetsrv\config). I would recommend you backup each before proceeding. In Apache, note that you and/or CF may have updated more than just the httpd.conf file but also a mod_jk.conf and you/your folks may have updated still others that could be "included" from these. I'd backup the whole conf folder.

How to reconfigure (or rebuild) the connector

So to reconfigure (or rebuild) the connector, you could use the CF web server configuration tool, which in Windows is accessible on Windows from Start>Programs>Adobe>ColdFusion 10>Web Server Configuration Tool.

Note that if you are not the person who installed CF10, you won't have that menu option. Instead, you can run the wsconfig.exe as found in C:\ColdFusion10\cfusion\runtime\bin.

And Linux users also would run ./wsconfig in that folder.

Before you do that, though, consider the following important additional details:

  • If you are running on Windows, don't run that tool yet. See the next section, on Don't forget to "Run as Administrator"!
  • If you are running multiple instances of CF 10 (on a single machine), it's NOT enough to just run that wsconfig that I just mentioned. See the important section below, Reconfiguring/rebuilding the Connector if you have multiple instances
  • Note that doing the reconfigure/rebuild of the connector will require a restart of the web server (IIS or apache). If you're not prepared to let that happen, don't proceed with a connector update.
  • You *may* be able to get away with only doing an "upgrade" rather than a reconfigure/rebuild of the connector, though it's pretty rare. See the section below on that, You may only need to do an "upgrade" rather than a "reconfigure/rebuild" of the connector
  • You may wonder why you've never heard about any of this. See Where can I learn more about all this?
  • And as I added in an update near the top here, do beware that when you reconfigure/rebuild the connector, it will cause you to lose any settings to the files in those numbered folders, to be sure to save them off and re-apply them. CF11 now prompts you to do that since updates were made to the connector tool in update 5.

I'll note as well that for some users, it may be useful to point out that there is also a jar version of the wsconfig tool, at C:\ColdFusion10\cfusion\runtime\lib (or the runtime\lib under a given additional instance, if you have added any.) You can see the docs and command-line help for any of these tools to learn more about using them.

And as I mentioned at the outset, in "the least you need to know", to do a "reconfigure/rebuild" of the connector (as opposed to an "upgrade" of it), you use the option to "remove" and then re-"add" the site connection.

Don't forget to "Run as Administrator"!

If you're on Windows and on either Server 2008 or 2012, or on Windows 7, 8, or even Vista, you should run this connector tool "as administrator"--even if you would say you "are" an administrator. Just take my word for it as the voice of experience: remember always to right-click on the tool (whether launching it from the Start menu or running the exe) and choose "run as administrator". You may not see a difference in how things work, but I promise you it will affect how it does its updates both to CF and to IIS. Many people's connector problems are due to them or others having failed to do this, perhaps in previous attempted connector updates. Things can get quite messed up, and this is not the post to talk about how to undo that mess. I can help via my consulting, as discussed elsewhere here.

Reconfiguring/rebuilding the Connector if you have multiple instances

If you may have implemented multiple CF10 (or 11) instances on a single box (only an option in CF Enterprise/Trial/Developer), then you will find that unlike CF9 and earlier, the WS Config Tool does NOT list your available instances. (Update: This problem is fixed in the connector tool in CF2016.)

Instead, you need to run that wsconfig as will be found in each instance (such as C:\ColdFusion10\instance1\runtime\bin), which will rebuild the connection of any selected web site(s) to that instance.

And as I said above, you can check the date of the isapi_redirect.dll (for IIS, or mod_jk.so, on Apache) in the numbered folders under config\wsconfig after doing the reconfigure/rebuild, to confirm that the file's date is relatively recent.

How can I know whether a given update DID offer an updated connector?

This is a reasonable question. I keep saying you want to check the date of the connector file (.dll or .so file) to make sure it's "recent". Why don't I say what date to look for?

Well, the problem is that the date to which it should "be updated" depends on which CF update you've applied and also what web server you're using..

Adobe's technotes for each update often DO tell you if you need to update the connector after applying a give CF1/11 update. Just note that if you or others may have skipped doing that on a previous update (where it WOULD have been called for but you did not), then you will STILL need to do it after this later update you're applying.

Sadly, there's no single page on the web which lists what date a properly updated file will have for each corresponding CF update. I've thought about doing one. For now, you just need to review the technote for any update you are applying (and any you're skipping), and hope that if a connector update WAS required that Adobe indicated that. (Note that sometimes I have added comments in the Adobe blog posts where they have announced a given CF updates, to indicate whether the technote DOES say that or I have found that the connector IS updated based on testing.)

You *may* only need to do an "upgrade" rather than a "reconfigure/rebuild" of the connector

I had mentioned above that some of the updates only require an "upgrade" of the connector, not a full update/reconfigure/rebuild. A reconfigure/rebuild is actually easier (and will do the job, even if only an "upgrade" is required), but for some folks an upgrade may be preferred.

To do an upgrade, if it's called for, you go to a different directory, C:\ColdFusion10\cfusion\bin\connectors, and run Upgrade_all_connectors.bat (or Upgrade_all_connectors.sh, if on Linux). While you can double-click that file to run it, from a file explorer, it would be best to run it from the command line, so you can see any output from the result of executing it (which output is lost if you just double-click the file to run it).

And again, if you are on one of the more modern versions of Windows I listed above, you should open the command prompt "as administrator", which you can do by using start>programs>accessories and right-clicking on "command prompt" (among other ways).

(It is indeed lamentable that there is no "upgrade" option listed in the GUI for the web server configuration tool. You have to do it via the command line. It would be nice if some day Adobe may add that. Update: CF2016 did add that.)

But the point here is that this "upgrade" option does indeed just "upgrade" rather than "reconfigure/rebuild" the connectors, which is suitable for some but not all of the CF10/11 updates, and isn't quite as heavy-handed (reconfiguring the connectors causes CF to remove/rebuild files in that CF [coldfusion]\config folder and also updates your web server configuration as appropriate.)

Again, the technotes for each update (offered via the "more info" link on each update screen) will explain if a given update calls for "upgrade" vs an update/reconfigure/rebuild.

Where can I learn more about all this?

So after reading all this, you may be wonder, "how the heck am I supposed to have known all this?". Well, it's really not that buried.

  • First, as I noted at the outset, there has been mention of this in most of the recent CF10 updates, literally on the update page shown to you as you apply the updates in the CF admin "Server Update" feature. It's just that many miss the mention, or don't read the "more info" link offered, which points to the technote. Now, it's worth noting that Adobe has only a couple of paragraphs of room on that update page, so that's why they don't get into more detail, but leave it to the technote to elaborate. And even then, some of the technotes have not been as clear as they could be on all this above. Obviously, there's a lot to communicate. They tend to be rather spartan. I hope this info will help more people facing these challenges.
  • I'll also note that there is info on both the update process and running the web server configuration tool, both the GUI and the command-line interface, in the CF Admin docs. Many are surprised to find that there even are docs for the CF Admin. (There is also online help, on each page of the Admin, accessed by clicking on the "?" in the top right corner, but often that is less than what's in the fuller docs.) See especially:
  • Besides the docs, there is much MUCH more info all about the CF10 update mechanism in a blog entry written by Adobe engineer Krishnap, offered at ColdFusion 10 Hotfix Installation Guide.

Finally, again if you need help with any of this, I provide CF server troubleshooting as an independent consultant. If you may interested to learn more, see my consulting page.

Update: Again, since writing this entry, I did a subsequent one on Still more reasons to make sure you have updated your #ColdFusion 10 web server connector, so be sure to read that next.

Hope all that's helpful. Let me know your thoughts.

For more content like this from Charlie Arehart: Need more help with problems?
  • If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
  • See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed
Good job.
Although I get the impression some folks may go looking for a rebuild option on the wsconfig after reading this, might be worth explaining exactly what rebuild means.
@Russ, thanks. First, I'll note that I do say at the outset (under "the least you need to know") that 'I use the phrase "rebuild" and "update" of the connectors rather interchangably, as does CF itself. We'll talk later about how there is in fact a difference between "rebuilding" and "upgrading" the connector.'

But I think you mean that in the "How to rebuild the connector" section, I merely point people to the web server config tool, and don't explain that you're to do there a "remove" and then "add".

In fact, I really meant to say that. I had been motivated to write this entry lsat night after addressing the issue again on a CF mailing list. It had come up so often that I had long meant to write such a blog entry. And in that email, I did in fact mention that a rebuild means to do a "remove" and "add" in the config tool. I see now I did not say that here. (It was very late at night as I was writing it.) I will correct that now.

I'll also add mention of how some lament (reasonably) that there is no option to do the simpler "upgrade" within the GUI, but only at the command line.

Thanks for the headsup.
yes that is what I meant, but was on my phone and on my way out so didn't go into details, I presumed you would get it :-)
In my experience most people don't really know anything about the connectors or what the wsconfig really does. In fact a lot of people do seem to use the wsconfig pointlessly for each new website, this creating loads and loads of connectors if you have a lot of sites, which doesn't really serve any purpose if you only have a single instance of CF and I do wonder why the wsconfig tool does this by default rather than just use an existing connector, or at least make it optional.
There is only one benefit to multiple connectors I have noticed, which is that sometimes the connector corrupts and sites stop working, so in this case it would only affect one site and not all. The down side is that you also may not even notice if you have loads of sites on the server.
It also means if you have a mass corruption, then you have a lot of connectors to rebuild , rather than just one.
Unless of course you specifically want to tune your connectors differently via the config file, but most folks running a vanilla install really are not going to be doing this or even know how I think.

So something to consider perhaps.

So for anyone reading, you do not *NEED* to use the wsconfig tool and create a new connector for each site. When you enable CF for ALL SITES it just uses just 1 connector for all sites, so this is the best option if all your sites are CF sites. If you do not want to enable CF for all sites, you can still achieve the same thing manually by simply adding the handler/mapping in IIS/Apache. Just look at an existing site and copy the setting. Plus of course the jakarta vDir for CF10.
Good point, Russ. I'll let them stand as commentary rather than fold any aspect of them into my entry. They're useful addition to the topic, but not really specific to it.

To be really clear, to anyone reading these comments and not the whole entry, I was NOT advocating any notion of adding new connectors. Russ is talking about people who themselves do it needlessly.

But I do agree with you, Russ, that the more connectors you have, the more there is to update/upgrade, and there are the other pros/cons to them that you mention. Fodder for another blog entry for another day. If you do one, feel free to come add a link here.
Charlie, this is great information. I'm running into a problem where I am unable to reconfigure/rebuild the web server connector, because it does not appear in the list of connections after configuration (when I execute wsconfig.exe a subsequent time). My attempts to update all via batch files result in a NullPointerException in the wsconfig.log file.

This is a multi-instance (each connected to a specific IIS website) setup. I ran each web server connector by instance. The sites are up and we've cleaned settings up by instance, but attempts to reconfigure the web server connectors to update the .dll fail.
@Paul, sorry I missed this before. Curious problem you report there. My only immediate thought is, did you use the "run as admin" option? Also, what if you ran it from the command line? maybe that would offer more info in the way of the failure.
Charlie, I just performed the rebuild using the Web Server Configuration Tool on my CF server and I'm on CF10 Update 12. This rebuild destroyed my server. First off, I removed all references to the CFIDE virtual directory on all sites in IIS when I initially setup CF10. It's common lock-down practice. This rebuild put them all back in. Furthermore, I'm now getting blank pages out of CF now. No error messages; just blank white.

Do you have any references on EXACTLY what a rebuild does and why an upgrade is not sufficient? It's making changes that are conflicting with a working installation and I need to get more details on it.
# Posted By Adam Winter | 12/27/13 5:23 PM
@Adam, I'm sorry to hear of your challenges, in doing this task which (to be clear) Adobe recommends. There can be a few explanations for your problems, and there are indeed solutions, so if you're feeling that CF is hopelessly broken, it is not.

So let's do clarify first, when you say it "destroyed your server" you refer to the fact that cf pages are now blank, right? I appreciate that with it not serving pages you feel it may as well be destroyed, but the good news is that whatever is wrong can be righted.

What the rebuild does is a couple of things. First related to files in CF, it creates a new connector file (.dll on Windows, .so on Linux) and some files related to it in the directory under config\wsconfig, and then it modifies the wsconfig.properties file to point to that.

Second, and what I suspect you're having trouble with, is that it then configures the web server (IIS or Apache) to make modifications with respect also to pointing to that connector file. In the case of IIS, it will do this in the ISAPI Filter, the isapi & cgi restrictions, and in the handler mappings (which are either at the server or site level). It will also create a jakarta virtual directory that points to the dll.

Finally, as you noted, it will also create a CFIDE virtual directory, pointing to the CFIDE within the CF instance.

And yes, one might argue they ought not put it there if it's been removed. And yes the Adobe CF lockdown guides do recommend removing it (in addition to other things, like creating an alternative cfscripts virtual directory).

But then notice also that they (in both the CF9 and CF10 versions) discuss implementing the IIS Request FIltering feature to secure the CF admin (and related directories and files to be protected), so that you're not really relying on removal of the CFIDE to protect you. If you did that, and the connector put them back in, it would not be so worrisome

But I realize that for you the bigger problem is the "blank CF pages". There has to be an answer for that. It could be a problem in the isapi filter, the isapi & cgi restrictions, the handler mappings. It could be at the site or server level. It could be something amiss in the underlying iis xml config files.

I don't know that it will be possible to debug that with you in blog comments. I do help people resolve problems like this (related to all kinds of things related to CF, web server configuration, etc.) And I specifically have helped many people recover from problems related to reconfiguring the connector.

For instance, besides the clues I offered in the last paragraph, another common source of problems is a failure to use the "run as administrator" option when using the CF web server configuration tool. That could lead the tool to be unable to make all the changes in IIS that it should have made. You might even want to just try that again, removing and re-adding it again. It could solve things. (And worst case, you could re-install CF, since you know you had it working before. But that really should not be necessary.)

If rebuilding the connector "as admin" does not help, and if you are unable to find and resolve the problem yourself with the other spots I proposed you look at, I am very confident I could help you do it, remotely, likely in less than 15 minutes. You can learn more about my services (rates, approach, satisfaction guarantee, and more) at the consulting page of carehart.org. I'll see if you reply tonight, or I can be available tomorrow (Saturday).

Hope something there helps.
Charlie, thanks a bunch for responding back so quickly. Fortunately, I have this on a virtual machine that I took a snapshot of before doing the upgrade, so I reverted back to a working state. Based on what you said, I narrowed down the problems to a couple of areas. I'll address each one individually.

I read several posts that said when they do the rebuild and choose "all" sites, they run into a similar situation as mine, but when they do them individually, it works fine. That tells me that the changes in IIS are occurring at the server level in applicationHost.config or at the site level in web.config. Using DiffMerge to compare my applicationHost.config file before and after, I found the web server configuration tool took out the existing <isapiFilters> entries and replaced them, but in the wrong section. That was causing the HTTP Error 403.0 - Forbidden error in module IsapiModule to the path c:\[install path]\wsconfig\1\isapi_redirect.dll. Putting those entries back in their appropriate place got CF running again without blank pages.

Also, the tool rewrites the workers.properties file in that same direction. If one followed the lockdown guide, they probably have a worker.cfusion.secret entry like I do. That line is missing after the tool runs. Make sure you have a backup of that, or you just need to reset it.

As for the CFIDE being put back into all the sites, I agree with you that a top level Request Filtering entry would mitigate that, everyone knows that security on a server comes in layers and when Adobe is putting that back in, they are chipping away at my layers. Looking back on the past year, Adobe doesn't seem to grasp the security mentality very well. Yup, I had to put that jab in there for Adobe because I'm a little nervous (and peeved) now that their ColdFusion code is "open source" without their approval.

I'm still unsure what exactly the web server configuration tool did other than replace the isapi_redirect.dll. The entries it made in my applicationHost.config file degraded by security and corrupted my isapiFilters entries. The workers.properties files was rewritten with exactly the same values, except that it took out my secret key entry (again, degrading my security). Is there another configuration change that the tool did that I could have simply done manually? You mentioned in your post that an "upgrade" can be performed. What else is the rebuild doing that the upgrade isn't?

Since my applicationHost.config file was negatively affected, is there any reason not to simply restore my old version? Are there any changes in there which are REALLY necessary with the connector rebuild?

Thanks for the offer on the consulting services. I may take you up on that offer next time. Your posting made me dig much deeper into this issue and I learned quite a bit more about the IIS/CF relationship. For that, I'm grateful.
# Posted By Adam Winter | 1/3/14 5:22 PM
Worth noting . . . You'll need to rebuild (or backup to restore after reconfigure) your uriworkermap.properties.
@Brian, let's be clear for all readers: that would not be true for everyone, right? Let's try to get on (and get our readers all) on the same page.

Most people don't muck with their uriworkermap.properties file, so the rebuild would just put it in the same form that it would have put it in when the connector or connectors were first built (before "rebuilding" them as described above).

I think you're referring to the fact that if someone has read some blog entries (perhaps even from Adobe) that suggested tweaking it for various reasons, those tweaks would be lost on a rebuild. That's a good point to make (for those folks).

I just wouldn't want readers of your comment (and my blog) to think that EVERYONE who rebuilds their connector needs to "rebuild" their uriworkermap.properties file.

Hope that helps. If you or anyone else has something more to say on this, feel free.
Wow, once again you have saved me. I spent most of the day getting w3wp.exe and isapi_redirect.dll errors thrown everytime I tried to post an XML file to my server that was over 7993 characters. Seriously tried setting about every request limiting setting I could find to no avail. Was about to throw in the towel when I came across this blog. Ran the update connectors .bat file and my problem was fixed immediately. Why the hell is that not run as part of any of the hot fixes for CF10??? I would have had no idea that bat file existed if I had not come across your article I may have been up all night installing CF9.

In the sake of helping others I am going to litter my post with some of the keywords I was using to find this solutions all day...
isapi_redirect request maximum, Faulting module name: isapi_redirect.dll, tomcat not allowing large requests to post
@Andy, thanks for the kind regards, and glad to help.

As for why Adobe doesn't run this as part of the updater, well, I suppose it's because the updater just traditionally has only done updates to CF itself, not the connector (or anything else, that I can recall.)

But we could make an argument that since the CF installer offers the option to have CF configure the web server connector initially, there's little reason that the updater couldn't do it also. But that's something to bring up with Adobe. I don't expect them to necessarily respond to anything we write here. If you might file a bug report, feel free to come back and report it here so others can vote it up.
First, thank you very much for posting such detailed notes and instructions on this topic. We've found them very helpful as we struggle with our new ColdFusion 10 server. Right now we're running: ColdFusion 10 Update 13 ... Version: 10,0,13,287689. We just built out this server (Windows Server 2008 R2) and installed CF10. While the server was still just used for testing and preparing for production, it was fine (very low to no traffic). The person who installed CF at first did not run the connector at all (we ended up creating the jakarta virtual directory on our own, manually). Once we moved our production CF applications over to the new server, we started experiencing regular trouble, where regularly the site would just return a blank white page. We would restart the CF10 Application Server Service, and it would be resolved ... for a little while (sometimes hours, sometimes days, and if we're lucky, a week), until it would go blank again. That's when we found ourselves at this article. I've rebuilt the connector twice, but the problem persists. Might you have any other thoughts/suggestions?

Again, many thanks.
Charlie, thanks for the info you publish re CF. I am one of those (probably thousands) of folk who has been stuck on CF5/6 and Homesite/Dreamweaver for years just because it worked for me and am now moving up to CF10 and CF Builder. So a huge learning experience in areas that I am not familiar, just struck me that there is possibly a market to help (lower tech) people like me migrate to CF Builder.

However, one question which I would like answered just for the avoidance of doubt on my part. I am trying to use the built in CF/Tomcat server in CF Builder 2.0.1 to locally create CF files etc and then FTP them up to the public server which seems to work. In this case I have assumed that I do not need to configure the connectors (ever) since when I look at the web server configuration tool there is no mention of the CF/Tomcat server.


I installed ColdFusion 10 on a new Windows 2008 R2 64 bit server with IIS7.5 setup.
Before installation, I had made sure that ISAPI Extensions, IIS Metabase and IIS 6 configuration compatibility, CGI and .NET framework features added.

Everything went well and I'm able to get ColdFusion up and running.

I created a test site with a virtual directory mapping 'jakarta' then I can access my pages without any problem.

I applied the mandatory update after that. Again it was successful and then by setting up some proxy details in jvm.config I can connect to and see the ColdFusion 10 updates within CF Admin.

I directly downloaded and installed update 12 and it was successful as I can see the version number changed as expected.

Then I ran 'Web Server Configuration Tool' in Administrator mode as mentioned in this article:


I removed and re-add the IIS.

Now problem 1:

I can see CFIDE has been removed and I cannot access it any more.

Problem 2:

When I access the test site I created before, I'm getting
HTTP Error 403.14 - Forbidden

If I access any specific .cfm pages I get below error:

HTTP Error 404.3 - Not Found

I think the update and re-configuration has messed up IIS settings.

Have I missed anything?
# Posted By Xiaofeng | 2/28/14 12:09 AM
Sorry for the delays in responding, folks. First, thanks to you all for the kind regards. As to your questions, I'll take them one at a time...

@Joe, as for continued problems you may have, there are too many possible reasons. And they may have nothing to do with the connector. I'm afraid this is one of those times when your best bet would seem to be to have someone help you to resolve your problem by "looking over your shoulder" with you, as I do in my consulting services. More at the consulting page at carehart.org. I help people solve nagging problems every day, generally in less than an hour.

@Kenny, you refer to your using "the built in CF/Tomcat server in CF Builder 2.0.1". Well, there really isn't any CF server built-into CF Builder. Maybe you mean the free development edition of CF. That's a full-fledged edition (actually equivalent to the CF "Enterprise" edition), just limited in number of concurrent requests allowed. And as with any edition of CF, you are asked during installation if you want to integrate with an external web server (IIS or Apache) or use CF's built-in one. I suspect that latter is what you chose, in which case yes you will see nothing listed as already installed in the wsconfig tool. So you're good to go and, as Joe Rogan would say, "evidently this connector issue is not a factor for you". (I'll take dated "Fear Factor" references for $200, Alex.) :-)

@Xiaofeng, I'm sorry to hear of your troubles. Here, too, I'm afraid it won't be possible to debug your problem here in the blog. There are just too many things that could have gone amiss. As with Joe, I'd propose that the most expedient resolution may be to have us work together on a consulting basis to resolve your problem. I have a satisfaction guarantee, so you won't pay for any time you don't feeel is valuable. It sounds like you did *almost* all as expected. I would note that since you manually configured your new site (initially) with a jakarta folder, that suggests you had not had the config tool do it for you. We might wonder why that was so, but I don't expect that the problems after running the wsconfig tool are necesarily related to that.

What I'd propose we'd do would be to look at your current configuration, confirm the exact error you're getting (perhaps differently than you have been doing), and then clean up the IIS configuration (at the site and server level) by removing the connector, making sure there are NO vestiges remaining of the (or any) old CF connector, and then add it back. If it still fails, there would have to be some other explanation, and I'm pretty confident we'd have it all working within an hour.

Hope that's helpful, to you all.
Hi Charlie,

Thanks for the proposal and suggestions about try to clean up old CF connections by wsconfig and add them back to see if it works.

By trying different options for IIS within Web Server Configuration Tool, I found after I removed all the connectors and then added back site by site, it is all working fine. However, if I only added connector for 'All' IIS sites, it is throwing the 404 and 403 errors.

Somehow after the CF update and when I initially re-run wsconfig, it screwed up IIS configuration (at server level)?

Now I just add my sites one by one as a workaround. Not sure how to fix it at the server level though.
# Posted By Xiaofeng | 3/2/14 6:40 PM
@Xiaofeng, as for the "all sites" still not working, I would suspect that there ARE still vestiges of old settings (either in IIS or in CF) about the formerly connected "all sites", which were NOT removed when you did the "remove" of each site and "all sites". I've seen it before.

And this is why I recommended that you may need to go through the IIS config files (server and site level) after having removed all the connectors, and confirm that there remain no vestiges (no references to ColdFusion's dll's, whether from 10 or even 9), and THEN I bet you would find that you could do the "all sites" (alone, or with other sites) and it would work.

If you may want to try that, it could help for you to confirm that it's not that you *can't* possibly get it to work but rather that perhaps something you did left it in a state where it did not. One of the most common problems, as I discuss above in both the blog and comments, is forgetting to use "run as admin" when running the wsconfig tool.

Your link to the "Still more reasons..." at the bottom of this page redirects you back to this page instead of the page you meant I think.
# Posted By Scott | 3/11/14 11:43 AM
@Scott, thanks so much. I have corrected that now.
<gasp> would you think that this is still a problem if I install a CF10 that was just freshly downloaded from Adobe? was it just something to be aware of in the early stages of CF10?
# Posted By Michael Peters | 3/16/14 2:02 PM
@Michael, absolutely the problem remains, even on recent downloads (at least as of this writing). Adobe has not built a new CF10 installer to solve this, though I have pleaded with them that they should (to also address the need of the "mandatory update" before other updates can be installed).

I will add more to clarify that above, but note that this would not be new to CF10. I noted the same in the past:

Just testing a new CF10 install on an old XP machine - will install it on a Windows2003 server tomorrow which has IIS. On my machine, I find that IIS is not even listed during the installation under "add web server configuration" - only Apache and SunJWS. Will IIS be listed on a machine that has IIS installed? what if not? (sorry if this is a very basic question - I find that I haven't installed CF on a real web server for a long time, and I don't know the most basic things)
# Posted By Michael Peters | 3/18/14 12:08 PM
@Michael, are you sure that the XP machine does indeed have IIS installed? You don't say, but I realize you may have thought it was implicit. I'll just note that on many versions of Windows, IIS is not installed by default, so that would certainly explain it. Since you say you haven't dealt with this sort of stuff in a long time, it's worth covering this basic point first.

Otherwise, yes I would expect that even CF10 should see an IIS implementation on XP. I mean, I'm sure that XP is not listed as a supported OS, and I suspect that IIS may be IIS 4 or 5, and I don't think CF has supported those for a long time. But I'm saying I expect it would still work. No promises, though. I've not run CF on XP for over 10 years, I'm afraid. Maybe someone else might chime in with more direct experience.

But confirm first if IIS is indeed on the XP machine. More important, I'm sure that your 2003 experience will be better (Assuming again that IIS is installed on that machine, which would be IIS 6, which CF10 does indeed work with.)
thx very much Charlie. We'll see later today how it will go :) best, -Michael
# Posted By Michael Peters | 3/19/14 12:32 AM
Charlie, thank you very, very much for covering this topic so carefully. I am disturbed (understatement) that Adobe does not pound us all day and night with alerts on the need to carefully attend to the web server connector when CF updates are installed. When I installed CF10 on my development machine in Dec '12, (and the 'CF10 Mandatory Update'), I opted for the automatic updates. This, I believe, is a big mistake. Updates were installed automatically, and I was unaware that I should be checking for the possible (likely) need to rebuild the web connector.

I have spent the last two days running down this error: "JSON parsing failure: Unexpected end of JSON string". I am including the error string so other poor souls who encounter this problem may find your blog. I have an app that moves some JSON data from an AJAX call on the client to a CF component. When I started to test with more production-like volume (still small really), I got the parsing failure when the volume approached 8K characters. Naturally, the 8K number sent me delving into the various query string limits, request limitations, etc. that IIS may being throttling. With no luck.

I then stumbled onto your blog, updated my web connector, and low and behold, all is well with the world. Thank you, again.
# Posted By Anita | 4/21/14 12:20 PM
Hi Charlie,

I have an old Windows 2003 R2 server which still runs CF8 with IIS 6.
The server is a production box in DMZ.
The only good thing is it's 64-bit and it got lots of RAM - about 20G.

Now I'm considering about install CF11 on this Windows 2003R2 server with IIS 6.

The reason behind that is:
- The company I work for will NOT decommission this server soon.
- Most of the development here now are based on local CF10/11 Dev environment.
- I'd like to get better security and performance, as well as better cfdocument capability which we used a lot to produce large PDFs out of HTML

By checking the system requirements matrix from Adobe for CF11, it looks like Windows2003R2 + IIS6 should be OK but it also looks like it kind of just hit the minimum requirements.
About a year and half ago I've done upgrades to CF10 on two Windows 2008 servers running IIS7.5 and it all went well and we rarely had any issue. (FYI I can't use these servers for certain sites as these are servers sit inside corporate network and can only serve internal sites).

But for upgrade to CF11 on Windows 2003 + IIS 6, I'm not sure if an old server like this will have any issue?

So my question really is have you (or anyone you know about) had similar experience and if you could share that will be helpful before I go ahead.
Because the server is in DMZ, I will have to install few things manually like MS VC++ re-distributable package and CF update etc.
For IIS7.5, ISAPI Extensions, IIS Metabase and IIS 6 configuration compatibility, CGI and .NET framework features need to be added. How about IIS 6? Anything that need to be aware of?

Thanks in advance,

# Posted By Xiaofeng Liu | 8/7/15 7:20 PM
Xiaofeng, as you know I had taken up this same discussion with you when you raised it the same day on the cfaussie mailing list. Have you resolved things?

As you note, yes, CF11 is formally supported on Win2k3 R2, with IIS6 (http://wwwimages.ado...). And yes, it's the oldest Windows/IIS combination supported for CF11, but it should work.

As for which specific IIS 6 features you may need, the docs do clarify, or you can just try and you will be told (both at installation and if you ever try to re-configure the connector) what features you need, if they are not enabled. And enabling them is easy and quick, in the Windows Server Manager.

If you have other troubles, you can follow up here, but I'd note that technically this subject is rather off-topic for this blog post, so to respect others let's keep it to a minimum.

And of course, if you "just want it working", I'm sure I could have you up and running in less than a half hour, if you may be interested in my remote consulting services (no need for you to give me remote desktop access. We'd work using a free, secure screensharing solution.) For more, see the consulting page at carehart.org.

Hope that's helpful.
Charlie, thanks for all the great thoughts.
I'm actually trying to "encourage" the company to approve a new Windows server. Because I think maybe CF11 can work with Windows 2003 but in the long run, if I can get a newer server, that would be less problems for me in the future, isn't it?

Now I need to confirm if CF11 can run on Windows 2012 Standard (not Enterprise). I know from the specs it says it can but I'm talking about a production box with large volume of traffic on it. Is it any different between running it on standard vs Enterprise?

Also for IIS, I noticed that there seems to be some IIS hanging issues for the combination of CF11 on Windows 2012 and IIS 8+. So I'm not sure if it is a good choice to go to this combination as a production box.

If 2012 is not a good option, I would suggest my company to get 2008R2 and IIS7.5 for me as I've done on that before without problems.

# Posted By Xiaofeng | 8/24/15 4:32 AM
Great article.

Just did update 12 to CF Server 11, reconfigured a few of my CF site connectors (IIS) and now my "DateField" form fields are not working correctly.

Before update, system would display default values, but instead now show "mm/dd/yyyy" . Also, choosing dates does not work.

System looks to be grabbing files from the CFIDE directory fine.

Any advice would be appreciated.
Jeff, I will say first that I doubt this is about your connector update (the subject of this post). And your problem could be caused by any number of things so this may be hard to debug via comments.

But first and foremost, you say "System looks to be grabbing files from the CFIDE directory fine. " The key question is how are you confirming that? Are you opening the developer tools in your browser (right-click on white space, choose "inspect"), and going to its network tab, then refreshing page, and watching requests made from the browser to the server based on your CFML/html?

And are you saying you see there in that list no 404s or 500 errors in any of those files that your browser is requesting of CF? especially the .js ones? If you DO see such an error and right-click the file and "open in new tab", do you see an explanation of it?

One of them may be, for instance:

(assuming you have not changed CF to find the CF scripts in another folder and changed IIS to have a virtual directory to point to that. Again, this is why you should view what YOUR browser shows as the files as being requested in YOUR server.)

And if you are using IIS, if you visit that failing URL in a browser on the server (rather than off the server), you may see still more detail (due to IIS's default setting for "error pages" showing more "details" for local browsers).

I'm not aware of CF11 update 12 itself removing those files. But perhaps something else has changed (though I realize you would feel the only change was the CF update).

This browsing tips above should help you, or look for that calendar.js file in the folder on your server's file system.

This could be about request filtering blocking CFIDE/scripts (which may have changed), it could be about your needing a CFIDE virtual directory defined (that got lost in your efforts to update of the connector, perhaps creating new sites), and so on.

One last somewhat related thing (in case someone else finds this post and comment, given these keywords we've mentioned): the latest CF2016 installer (release in December 2016) DOES remove the underlying javascript libraries that supported many CFML js-based UI elements. See the blog post here:


and how they mention that among other things the YUI toolkit (which supports many javascript-based UI elements in CF) has been REMOVED. Such features were marked as deprecated when CF2016 first came out in Feb of last year, but in this new installer they have REMOVED the underlying libraries that support them.

Now, it's not that you're screwed. The blog post explains how someone (on that edition of CF2016) can download the needed files from a URL they offer, and they show how to implement them in the right place (like I show above).

But that should NOT have affected CF11, per an update. I have CF11 update 12 and I still have that file. So I really wonder if you may find another explanation.

Indeed, as a last possibility, you don't mention confirming that your CF11 update 12 ran with zero errors. For more on how to confirm that (don't rely on what the updater UI told you), see:


Finally, if despite all this you find you STILL can't find the answer, I'll propose that:

a) you share a simple cfm page with the most basic few-line demonstration of what you're finding fails (so that I can test it on MY cf11 update 12. And as you may know, sometimes in doing that, you find that there's some other explanation for the failure you see, even before sharing it with others.)

b) or of course I can help you with this via my paid remote short-term consulting. I don't see it needing more than 15 mins to resolve (and of course I've spent more than that in writing this up, but if it helps you or others great). I discuss my rates, approach, its safety/security, my satisfaction guarantee, and more at http://carehart.org/...

Hope something in there is helpful. Please do let us know how it goes.
Copyright ©2024 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the html in this page?)

Managed Hosting Services provided by
Managed Dedicated Hosting