ColdFusion 9 (Codenamed: Centaur) was released on October 5, 2009 and is supported on Windows Server 2003 and Windows Server 2008 incl. R2.

However, you may want to use this expensive product on newer operating systems as well. I was able to install CF9 on Windows Server 2012 R2 x64, but i never documented the path how i made it work. I remember it was a lot of headache, try and error many many hours, consulting thousands of websites, collecting piece by piece, to make it work at the end.

To fill this documentation gap, i took another run to perform and document the installation on Windows Server 2016 x64. The instructions below will potentially also work with Windows Server 2012 R2 and/or Windows 10.

Preparations

Install IIS

Make sure have installed Microsoft IIS with the following options. Important at this stage, you have to select those two options:
– ISAPI Extensions
– IIS 6 Metabase Compatibility

Test IIS

Test your IIS installation by opening http://localhost directly on your server.

ColdFusion 9

x64 Installation

1. Execute the ColdFusion 9 x64 installer in Windows 7 compatibility mode and as administrator (ColdFusion_902Full_WWEJ_win64.exe).
   
2. The installer will quit after a while or will never pop up.
3. Goto the directory: %temp%\2\I1522355894\Windows and find adobe_cf.exe. Open the file properties and set the Windows 7 compatibility mode and execute it as administrator as well.
4. In case you run adobe_cf.exe now, the installer will quit with the same problem as before. Errorlogs will be produced:
   a)  %temp%\2\I1522355894\Windows\cfinstall_err

   IAResourceBundle: create resource bundle: en
   ZeroGur: Windows DLL failed to load
   at ZeroGa4.b(DashoA10*..)
   at ZeroGa4.b(DashoA10*..)
   at com.zerog.ia.installer.LifeCycleManager.b(DashoA10*..)
   at com.zerog.ia.installer.LifeCycleManager.a(DashoA10*..)
   at com.zerog.ia.installer.Main.main(DashoA10*..)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at com.zerog.lax.LAX.launch(DashoA10*..)
   at com.zerog.lax.LAX.main(DashoA10*..)
   IAResourceBundle: create resource bundle: en
   ZeroGur: Windows DLL failed to load
   at ZeroGa4.b(DashoA10*..)
   at ZeroGa4.b(DashoA10*..)
   at com.zerog.ia.installer.LifeCycleManager.b(DashoA10*..)
   at com.zerog.ia.installer.LifeCycleManager.a(DashoA10*..)
   at com.zerog.ia.installer.Main.main(DashoA10*..)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at com.zerog.lax.LAX.launch(DashoA10*..)
   at com.zerog.lax.LAX.main(DashoA10*..)
   IAResourceBundle: create resource bundle: en

   b) %temp%\2\I1522355894\Windows\hs_err_pid<pid>.log

   #
   # A fatal error has been detected by the Java Runtime Environment:
   #
   # EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x00007ffc9a7a8af2, pid=4316, tid=3964
   #
   # JRE version: 6.0_29-b11
   # Java VM: Java HotSpot(TM) 64-Bit Server VM (20.4-b02 mixed mode windows-amd64 compressed oops)
   # Problematic frame:
   # C [ntdll.dll+0xa8af2]
   #
   # If you would like to submit a bug report, please visit:
   # http://java.sun.com/webapps/bugreport/crash.jsp
   #
   --------------- T H R E A D ---------------
   Current thread (0x000000000088e800): JavaThread "main" [_thread_in_Java, id=3964, stack(0x0000000002380000,0x0000000002480000)]

5. Googling around will bring up, that this is a potential bug within Java 6 U29. See here and see here.
6. The solution i found was to download Java 6 U45 x64 (jre-6u45-windows-x64.zip) and install it on the server to the default location (C:\Program Files\Java\jre6).
7. After the installation is complete, rename the folder %temp%\2\I1522355894\Windows\resource\jre to %temp%\2\I1522355894\Windows\resource\jre.old.
8. Copy the folder C:\Program Files\Java\jre6 to %temp%\2\I1522355894\Windows\resource\jre
9. After this step you can uninstall Java 6 U45, it will not be used anymore.
10. Execute adobe_cf.exe from chapter 3 again (with compatibility settings) and holy shit the installer will be launched:
    
11. Add your serial number or select the right option for your installation:
    
12. At this stage select “Server configuration” and click on Next.
    
13. Select all services and proceed.
    
14. I suggest to use the default directory suggested by the installer for the installation: C:\ColdFusion9
15. Select “All Websites”
    
16. Select the path of the “Default Website” for the ColdFusion Administrator (C:\InetPub\wwwroot\ by default)
    
17. Enter a good password for the ColdFusion Administrator.
18. Do not enable RDS because regarding cve-2013-0632 it’s security is broken.
    
19. Click on “Install” to install CF9
20. Installation in progress …
    
21. Installation complete
    
22. After you click on Done, the default browser will be launched and you may see the error-message below. Don’t be confused and proceed with the configuration chapter.
    

x64 IIS Configuration

1. 1. I successfully tested following two ISAPI modules:
      – jrun_iis6_wildcard_32bitAppPool.zip
      – jrun_iis7_32bitAppPool.zip
   2. Download both archives and …
      – extract jrun_iis6_wildcard_32bitAppPool.zip to C:\ColdFusion9\runtime\lib\wsconfig\1
      – extract jrun_iis7_32bitAppPool.zip to C:\ColdFusion9\runtime\lib\wsconfig\2
   3. You are free to descide what version you would like to use. I did not find any differences here.
   4. Additional details
      In case you want play around with different ISAPI modules, you can download my complete collection here. A article with a lot of details from Asha K S can be found here. Her article did not work very well for me but it contained the basics i had used to make it work. Especially the topic about “Step 4: Configuring Web Server IIS 7” did not work like described. During my tests i was not able to make ColdFusion work with the ISAPI modules delivered within the suggested wsconfig.jar. In case you are interested what i had to make differently, please read her article and compare my two downloads from above (download also contains working ISAPI modules).Hint: I was not able to run my IIS application pool in a dedicated x64 mode, i had to enable x86 compatibility in any case.
   5. Open your IIS Management Console and browse to the server-level and doubleclick “Handler Mappings”.
        
   6. Because i only run ColdFusion websites and static content, and because of security reasons, i have removed/deleted all handlers here. The only one i did not delete is the handler with the name “StaticFile”.
   7. After all handlers where removed i created the handlers required for ColdFusion9. Add following “Script Map” handlers manually.
      
      cfcHandler
      Request path: *.cfc
      Executable: C:\ColdFusion9\runtime\lib\wsconfig\2\jrun_iis7.dll
      Name: cfcHandler
      Click on “Request Restrictions”
      Mapping: Invoke handler only if request is mapped to: File
      Verbs: One of the following verbs: GET, POST
      Access: Script
      After you clicked OK, confirm with ‘Yes’ to allow the new ISAPI Extension.

      cfmHandler
      Request path: *.cfm
      Executable: C:\ColdFusion9\runtime\lib\wsconfig\2\jrun_iis7.dll
      Name: cfmHandler
      Click on “Request Restrictions”
      Mapping: Invoke handler only if request is mapped to: File
      Verbs: One of the following verbs: GET, POST
      Access: Script
      After you clicked OK, confirm with ‘Yes’ to allow the new ISAPI Extension.

      cfrHandler
      Request path: *.cfr
      Executable: C:\ColdFusion9\runtime\lib\wsconfig\2\jrun_iis7.dll
      Name: cfrHandler
      Click on “Request Restrictions”
      Mapping: Invoke handler only if request is mapped to: File
      Verbs: One of the following verbs: GET, POST
      Access: Script
      After you clicked OK, confirm with ‘Yes’ to allow the new ISAPI Extension.

      cfswfHandler
      Request path: *.cfswf
      Executable: C:\ColdFusion9\runtime\lib\wsconfig\2\jrun_iis7.dll
      Name: cfswfHandler
      Click on “Request Restrictions”
      Mapping: Invoke handler only if request is mapped to: File
      Verbs: One of the following verbs: GET, POST
      Access: Script
      After you clicked OK, confirm with ‘Yes’ to allow the new ISAPI Extension.

      JWildCardHandler
      Request path: *
      Executable: C:\ColdFusion9\runtime\lib\wsconfig\2\jrun_iis7.dll
      Name: JWildCardHandler
      Click on “Request Restrictions”
      Mapping: Invoke handler only if request is mapped to: File
      Verbs: One of the following verbs: GET, POST
      Access: None
      After you clicked OK, confirm with ‘Yes’ to allow the new ISAPI Extension.

   8. Make sure the Handlers are sorted within the correct direction. Click “View Ordered List” on your right hand within the Management Console.Sort your records like listed in the screenshot below:
      
   9. Make sure your ‘Application Pool’ is set to x86 compatible. Right click your Application Pool and select Advanced Settings. Set Enable 32-bit Applications to “True”.
         
   10. Try to launch the ColdFusion Administrator again by opening http://127.0.0.1/CFIDE/administrator/index.cfm
   11. Login by using the password you have choosen for the ColdFusion Administrator and wait until the CF initialization has been completed.
   12. Limit access to the ColdFusion Administrator only from 127.0.0.1, because regarding CVE-2013-1388 it’s security is broken.

Found on Windows Server 2019 – Troubleshooting:
– If the ColdFusion Administrator does not load, then allow “all verbs” on the configration of the handlers (chapter 7).
– If the ColdFusion Administrator does not display any images, please make sure the “JWildCardHandler” is below the “StaticFile” handler in the ordered list (chapter 8).

Securing ColdFusion 9

Restrict access to the ColdFusion Administrator

1. Make sure no one else than you can open the ColdFusion Administator Website, for example work with IIS Bindings.
2. Open IIS MMC and edit the bindings of your “Default Web Site” containg your ColdFusion Administrator (/CFIDE directory).
   
3. Allow connections only to the local loopback interface by configuring 127.0.0.1 as IP address.
   

Hint: To make http://localhost on IPv4 working, you may need to disable IPv6. In case you won’t do that, please add a Binding for the IPv6 loopback address (::1).

Update JDK version of ColdFusion server

ColdFusion can only run on top of JDK or JRE with Server VM. Oracle also started providing separate download link for JRE and Server JRE. ColdFusion only works with JDK or Server JRE and not with Client JRE [For more details refer to this article].

1. Download the latest minor version of the supported JDK or Server JRE from Oracle or jump to step 2.
2. Download the  jdk-7u80-windows-x64 and install it.
3. After the installation of the JDK stop the “ColdFusion 9 Application Server”
4. Rename the directory C:\ColdFusion9\runtime\jre to C:\ColdFusion9\runtime\jre_1.6.0_u45
5. Copy C:\Program Files\Java\jdk1.7.0_80\jre to C:\ColdFusion9\runtime\jre
6. Copy C:\ColdFusion9\runtime\jre\bin\msvcr100.dll to C:\ColdFusion9\runtime\bin\msvcr100.dll
7. Start the ColdFusion Application service.

Interesting:
I have successfully tested Java 7 Update 80 but i was not able to make any .cfm page work with newer Java 8 versions, so therefore i did not proceed to test Java 9 and Java 10.
Additional references:
– CF9 and Java 8
– Which JDK is supported with ColdFusion 9, 10, and 11?
– SSL Version with Java/CF

In case you have problems replacing the Java Runtime, please read here and read here.

x64 Website configuration

For serveral reasons (cfchart, cffile action = “upload”, cfimage, etc…) it’s sometimes required to create following directories within a productive IIS Web Site.

/CFIDE
Copy the content of the CFIDE directory from your “Default Web Site” (C:\inetpub\wwwroot) to the root directory of the new Web Site. For security reasons: Do not forget to delete the CFIDE\administrator directory afterwards.

/JRunScripts
In the root of your Web Site create a virtual directory mapping within IIS.
Map the virtual path /JRunScripts to C:\ColdFusion9\runtime\lib\wsconfig\1

/CFFileServlet
In the root of your Web Site create a virtual directory mapping within IIS.
Map the virtual path /CFFileServlet to C:\ColdFusion9\tmpCache\CFFileServlet

Update of 15. August 2019 – Make TLS 1.1 and TLS 1.2 available in ColdFusion 9

I was in the need to get TLS 1.2 support with CF9 and i was able to manage to install JAVA 8 who comes with TLS 1.2 support enabled.

I saw that there is a startup parameter to force JAVA to support those procotols:

-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2

Unfortanetly those parameters do not work with the public available Java 7 Update 80 – you have to be a business user to be able to download Java 7 Update 131 or newer.

Following steps to make CF 9 TLS 1.1 and TLS 1.2 compatible:

1. Download jdk-8u25-windows-x64.zip
2. Install only JRE
3. Rename C:\ColdFusion9\runtime\jre to C:\ColdFusion9\runtime\jre_1.7.0u80
4. Copy C:\Program Files\Java\jre1.8.0_25 to C:\ColdFusion9\runtime\jre
5. Open C:\ColdFusion9\runtime\bin\jvm.config
6. Here are my # arguments to VM

   # arguments to VM
   java.args=-server -Xms256m -Xmx1024m -Dsun.io.useCanonCaches=false -XX:MaxPermSize=512m -XX:+UseParallelGC -Xbatch -Dcoldfusion.rootDir={application.home}/../ -Dcoldfusion.libPath={application.home}/../lib -Duser.language=de -Duser.region=CH -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 -Dcoldfusion.classPath={application.home}/../lib/updates,{application.home}/../lib,{application.home}/../gateway/lib/,{application.home}/../wwwroot/WEB-INF/flex/jars,{application.home}/../wwwroot/WEB-INF/cfform/jars
   

• I’ve tested all older Java 8 versions: Important: The latest Java version, the CF9 server does render any CFML files with, is: Java 8 Update 121 (all newer versions do not work anymore…!).
• Download jdk-8u121-windows-x64.zip
• Btw: I’ve found a bug who probably requires a code change on your side. You are affected if you use CF9 with Java 8 in combination with <cfdocument> and embedded images via <cfhttp> tags, all CF9/Java 8 combinations are affected:

If you use <cfdocument> and you have an image embeded via https like seen below, then you can not read the image over https anymore – even if <cfhttp> will work totally normal with the rest of same site. If you switch to http, then it will work again.

<p><img alt="" src="https://www.myhost.com/data/4902JA40504E52544850B0441/images/brother.png" style="height:146px; width:120px" /></p>

Crazy: The image will no show up in the PDF document, instead you only will see a red cross.

If it would fit your need, the workaround would be to use a local path to your image file and use localUrl=”yes” within your cfdocument-tag.

<cfdocument format="PDF" bookmark="yes" pageType="A4" margintop="1.0" localUrl="yes">
<p><img alt="" src="#ExpandPath( "data/4902JA40504E52544850B0441/images/brother.png")#" style="height:146px; width:120px"></p>