topic Re: Another TLS Assist Request/Question in Integration and Testing

Another TLS Assist Request/Question

sycomputing — Thu, 25 Jan 2018 21:18:00 GMT

According to this:

https://community.developer.authorize.net/t5/Integration-and-Testing/Sandbox-URL-to-test-TLS-Update/m-p/57983/highlight/true#M32664

it would appear that transaction requests submitted to https://test.authorize.net/gateway/transact.dll cannot complete if the submitting application is not TLS 1.2 compliant.

Have I understood this correctly?

My application is compiled with Visual Studio 2010 and .NET 4, which, as I understand it anyway, requires a hack to make it work with TLS 1.2. For example, I've read that if the following code (bolded) is implemented in the global.asax file of a .NET 4 application, it will use the proper protocol without incident:

protected void Application_Start(Object sender, EventArgs e)
        {
            // Enforce the security protocol to TLS 1.2

            //System.Net.ServicePointManager.SecurityProtocol = (System.Net.SecurityProtocolType)3072;

            Application["TotalUsers"] = 0;
            Application["CurrentUsers"] = 0;
        }

My quandry has to do with the fact that I just placed my app in test mode, which tests transactions against https://test.authorize.net/gateway/transact.dll and the test went through fine, i.e., I got a TEST MODE receipt from both Authorize.Net and my application.

As you can see, however, the required code is commented out, meaning it shouldn't have been capable of utilizing TLS 1.2?

I'm concerned I'm not seeing something correctly here.

Any help is appreciated.

Re: Another TLS Assist Request/Question

sycomputing — Thu, 25 Jan 2018 23:39:41 GMT

So this message from Richard in the thread I cited above is NOT true?

Re: Sandbox URL to test TLS Update

‎05-06-2017 08:09 PM

@redbrad0 The endpoint https://test.authorize.net/gateway/transact.dll is now configured to only accept TLS 1.2 connections.

https://www.ssllabs.com/ssltest/analyze.html?d=test.authorize.net&latest

Richard

Re: Another TLS Assist Request/Question

Anurag — Thu, 25 Jan 2018 23:58:43 GMT

Hi @sycomputing

TLS 1.2 is enabled for sandbox already .

https://www.ssllabs.com/ssltest/analyze.html?d=test.authorize.net

We are going to disable TLS 1.0/1.1 for production url on Feb 28 , 2018 .

Re: Another TLS Assist Request/Question

sycomputing — Fri, 26 Jan 2018 00:19:27 GMT

Hi Anurag:

Thanks for your reply.

Then as I understand you, if my application using AIM currently successfully submits transactions via the sandbox at -

https://test.authorize.net/gateway/transact.dll

- then transactions at the production URL -

https://secure.authorize.net/gateway/transact.dll

will succeed after Feb 28th with no futher code modification on my part?

Is this correct?

Re: Another TLS Assist Request/Question

Anurag — Fri, 26 Jan 2018 06:27:27 GMT

Yes if the same version of the application running on sandbox is also on the production .

Also we are doing temporary disablement of TLS 1.1/1.0 on production on one of the following dates and time:

Akamai-enabled API connections will occur on January 30, 2018 between 9:00 AM and 1:00 PM Pacific time.

All other API connections will occur on February 8, 2018 between 11:00 AM and 1:00 PM Pacific time

You can monitor your system during these time to check if any issues are coming .

Thanks

Re: Another TLS Assist Request/Question

sycomputing — Fri, 26 Jan 2018 15:41:34 GMT

Thank you!