topic Re: TLS 1.2 Migration in Integration and Testing

TLS 1.2 Migration

msamama2018 — Thu, 08 Feb 2018 15:26:23 GMT

Hi,

I received an email about "Important TLS 1.0 Disablement ".

1- We are using Authorize.Net on our Joomla / PHP website.

Our web site is hosted on the Windows Server 2012 R2.

To verify my changes I setup sandbox and test server but sandbox doesn’t response to any test transaction.

What updates should be done from our side to make the website work with Authorize.net?

thaks.

Re: TLS 1.2 Migration

Anurag — Thu, 08 Feb 2018 19:23:28 GMT

Hi @msamama2018

Please have a look at our TLS 1.2 FAQs https://support.authorize.net/authkb/index?page=content&id=A1623

https://community.developer.authorize.net/t5/News-and-Announcements/Temporary-Disablement-of-TLS-1-0-1-1-on-Production-February-8/m-p/61351#M201

Reach out to our CS teams at 1.877.447.3938 if need more information .

Thanks

Re: TLS 1.2 Migration

NexusSoftware — Fri, 09 Feb 2018 12:22:07 GMT

As a start you could create a simple function to check the status of your server's TLS:

using System;
using System.Net;
using System.IO;

namespace howsMySSL
{
    public partial class Default : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;
            var response = WebRequest.Create("https://www.howsmyssl.com/a/check").GetResponse();
            var responseData = new StreamReader(response.GetResponseStream()).ReadToEnd();
            Response.Write(responseData);

        }
    }
}

Or with PHP :

<?php 
$ch = curl_init('https://www.howsmyssl.com/a/check');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$data = curl_exec($ch);
curl_close($ch);

$json = json_decode($data);
echo $json->tls_version;

The JSON reponse should show something like the following:

{"given_cipher_suites":["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","TLS_RSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_128_GCM_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA256","TLS_RSA_WITH_AES_128_CBC_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_AES_128_CBC_SHA","TLS_RSA_WITH_3DES_EDE_CBC_SHA"],"ephemeral_keys_supported":true,"session_ticket_supported":true,"tls_compression_supported":false,"unknown_cipher_suite_supported":false,"beast_vuln":false,"able_to_detect_n_minus_one_splitting":false,"insecure_cipher_suites":{},"tls_version":"TLS 1.2","rating":"Probably Okay"}

If the tls_version is less than TLS 1.2, then some server configuration needs to be addressed(with Windows 2102, this shouldn't be the case), else you can then check your cURL / OpenSSL / NSS version with the following:

<?php    
$curl_info = curl_version();
echo $curl_info['ssl_version'];

OpenSSL includes support for TLS v1.2 in OpenSSL 1.0.1

NSS included support for TLS v1.2 in 3.15

Re: TLS 1.2 Migration

atripathi — Mon, 12 Feb 2018 12:11:27 GMT

We have updated our server for TLS 1.2... The changes were tested and working successfully as applications on this machine are calling UPS API, who have already enforced TLS 1.2... However, we are still worried as we are using an old DLLs from Authorize.Net for Asp.Net framework 2.0 named ETransact.dll (version 1.0.2307)... We doubt that DLL may have issues in making TLS 1.2 connection...

The DLL allows switching between test/live modes... I performed a payment in the test mode, which was successful... But I am not sure, when I am making a payment in the test mode, then I am hitting the sandbox URL to test TLS 1.2, or I need to hit some other endpoint... And, if I need to hit some other endpoint, then what choices do I have... I can not change the service endpoint within DLL...

Thanks

Arvind

Re: TLS 1.2 Migration

NexusSoftware — Mon, 12 Feb 2018 13:11:35 GMT

You should know completely the functionality of any DLLs, that your application is using, especially one as old at that. One way is decompile the DLL and see exactly what is happening and if need be, rewrite it to suite your purposes.

if you must use the SDK, it would be recommended to upgrade to the newest version.

Re: TLS 1.2 Migration

atripathi — Tue, 13 Feb 2018 08:49:50 GMT

I decompiled the DLL, and found that it is hitting following URL in Live mode:

https://secure.authorize.net/gateway/transact.dll

and the following URL in Test mode:

https://certification.authorize.net/gateway/transact.dll

The sandbox URL provided by Authorize.Net to test TLS 1.2 is:

https://test.authorize.net/gateway/transact.dll

I can not make changes to the dll to hit the sandbox URL provided by Authorize.Net to test TLS 1.2... What option do I have for performing the test?

Thanks

Arvind

Re: TLS 1.2 Migration

NexusSoftware — Tue, 13 Feb 2018 08:54:21 GMT

Build your own DLL that calls the correct API endpoint or use the newest version of the SDK.

Re: TLS 1.2 Migration

atripathi — Tue, 13 Feb 2018 09:47:39 GMT

What is the recommended way to post to API endpoint... Is it essential to build a DLL... Can we write the code, which directly performs the post to API endpoint... Are there any guidelines available?

Re: TLS 1.2 Migration

NexusSoftware — Tue, 13 Feb 2018 10:12:43 GMT

Yes, you can write the code that posts directly to the endpoint, in many cases that is the better solution.

Re: TLS 1.2 Migration

atripathi — Tue, 13 Feb 2018 12:01:55 GMT

Are there any guidelines available to perform post directly from the code... And, is there a sample code available in asp and asp.net to post directly...

Thanks

Arvind

Re: TLS 1.2 Migration

NexusSoftware — Tue, 13 Feb 2018 12:59:35 GMT

Which type of transaction are you looking to make from your code? Basic Charge a Credit Card / createTransactionRequest, Accept Hosted or something else?

Re: TLS 1.2 Migration

atripathi — Wed, 14 Feb 2018 04:45:55 GMT

We perform credit card transactions...

Re: TLS 1.2 Migration

trucktax — Thu, 01 Mar 2018 19:05:48 GMT

Hello Team

Please help me to fix the issue of

" could not create ssl/TLS Secured channel" i am using windows 2012 RS server

i tried with nartec , Cipher GUI, but after restarting the same issue, user could not make the payment

kindly help me

Re: TLS 1.2 Migration

NexusSoftware — Sun, 04 Mar 2018 12:59:28 GMT

What is the code you are using to make your web request?

Re: TLS 1.2 Migration

khangphudat — Mon, 05 Mar 2018 03:48:38 GMT

tôi cũng gặp tình trạng này :(

Re: TLS 1.2 Migration

saigonlight — Wed, 04 Apr 2018 07:35:51 GMT

me too!

đơn vị tổ chức sự kiện

Re: TLS 1.2 Migration

duydiem6868 — Mon, 18 Jun 2018 06:44:10 GMT

I use Wordpress but I received an email about "Important TLS 1.0 Disablement ".
Please help me.

Re: TLS 1.2 Migration

duydiem6868 — Mon, 18 Jun 2018 12:47:30 GMT

Tôi cũng bị tình trạng tương tự thế này, vui lòng giúp tôi:

Re: TLS 1.2 Migration

kikmak42 — Mon, 18 Jun 2018 09:21:59 GMT

Hi @duydiem6868

The API supports TLS 1.2 only, and if your integration is working fine now you don't need to worry about anything. You already have TLS 1.2

Translated version :

API chỉ hỗ trợ TLS 1.2 và nếu tích hợp của bạn hoạt động tốt, bạn không cần phải lo lắng về bất kỳ điều gì. Bạn đã có TLS 1.2

Hope this Helps !