Production ColdFusion 2025 behind a shared Apache: the installation takes 34 seconds, the details take the attention

None of the five points below is in the installation manual, and each of them costs an afternoon when it comes as a surprise.

Error 503 although ColdFusion runs: localhost is not always 127.0.0.1

After the connector was in place, Apache answered 503 Service Unavailable while ColdFusion itself answered correctly. wsconfig writes the name localhost as the address of the ColdFusion server. The connector resolved it to the IPv6 address ::1, and the AJP connector of the Tomcat inside ColdFusion listens only on 127.0.0.1. The connector log says what to look for:

connect to ::1:8024 failed (errno=111)
(cfusion) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=111)

The fix is the address 127.0.0.1 in the worker definition and in the properties file in which wsconfig keeps the connector parameters, so that a later run of the tool does not bring the name back. On a new installation the tool accepts the address as an option. What not to do: open the AJP port on all interfaces. An open AJP port is a known attack vector, Ghostcat, CVE-2020-1938.

The connector reaches into every virtual host

No symptom at all, and that is the problem: nothing breaks until another site on the same Apache uses a path the connector regards as its own. wsconfig in ColdFusion 2025 copies the mappings into every virtual host, and they cover more than CFML files:

/rest/* = cfusion
/restapps/* = cfusion
/mcs = cfusion
/cffileservlet/* = cfusion
/*.jsp = cfusion

A PHP application with an API under /rest/ on the same server could end up in ColdFusion. Before the restart we searched the access logs of the other services for these paths, found nothing, and recorded their HTTP codes; after the restart we compared. Where a collision is real, the tool can configure the connector for one virtual host only.

The connector changes more than you see

On Debian the tool copies the module and creates its configuration directly in the Apache directory, while two further files land in the ColdFusion directory. It appends two include lines to the main Apache configuration, and it adds a secret to the AJP connector in the server configuration of ColdFusion, so ColdFusion has to be restarted too. It does not recognise Debian, which turns out to be harmless. The lesson: the connector files live in two places, so backups, configuration management and updates have to cover both.

Reports of Apache crashes after the connector

On the Adobe forum, users of ColdFusion 2025 reported that Apache on Ubuntu would randomly fail to start after the connector was added. We ran five full stop and start cycles on Apache 2.4.67 with the connector module of the April 2026 build, as of 2026-10: every cycle ended with a clean start and a response from the test page, and the system journal showed no crash. On a shared server this test belongs to the installation, not to the first restart after a system update.

The server profile is not a formality

The JVM configuration template in the installer carries a default heap and the parallel garbage collector. An installation with the development profile adds a debugger agent at the front of the JVM arguments, which is not in the template. In production we choose the production and secure profile and read the JVM configuration after the installation instead of assuming it is the default. For the same reason we never copy that file from a test environment to production. How a heap that is too small for the load behaves is the subject of another project.