0

Authorize.net will disable older protocols, TLS 1.0 and TLS 1.1, which are highly vulnerable to security breaches. They will be disabled by Authorize.Net on February 28, 2018

What type of protocol and API connection does CiviCRM use?

1

CiviCRM will communicate with AuthorizeNet using whatever versions of TLS are enabled on your server.

To see if your server is using TLS 1.2, go to https://www.ssllabs.com/ssltest and put in your url

in the Configuration section of the report it will list the TLS versions supported. enter image description here

  • I also just found this little one liner that will tell you what versions are available on your server openssl ciphers -v | awk '{print $2}' | sort | uniq but it seems to print all those available and not only those enabled. the machine in the image above that has only 1.2 enabled gave this result $ openssl ciphers -v | awk '{print $2}' | sort | uniq SSLv3 TLSv1 TLSv1.2 – ericG Jan 27 '18 at 4:22
  • When CiviCRM is making a request to Authorize.net (transaction setup & submission), it's PHP that requires support for TLS v1.2. When Authorize.net is making a request to CiviCRM (eg IPN), it's your webserver (or SSL terminator) that requires TLS v1.2. The SSLLabs test covers only the second of those scenarios; the former can be found in the output of phpinfo() or php -i | grep -i tls. For most servers these will be the same (in which case the openssl test is fine), but you really want to be checking the CiviCRM-to-Authorize.net route IMO. Or just run a test transaction 😀 – Chris Burgess Jan 29 '18 at 8:02
  • a big +1 for the extra info and details. Thanks Chris – ericG Jan 30 '18 at 3:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.