Authorize.net will disable older protocols, TLS 1.0 and TLS 1.1, which are highly vulnerable to security breaches. They will be disabled by Authorize.Net on February 28, 2018
What type of protocol and API connection does CiviCRM use?
asked Jan 25, 2018 at 20:51
-
This question might be deemed a duplicate of civicrm.stackexchange.com/questions/19503/…– petednz - fuzion ♦Jan 27, 2018 at 22:08
Add a comment
|
1 Answer
CiviCRM will communicate with AuthorizeNet using whatever versions of TLS are enabled on your server.
To see if your server is using TLS 1.2, go to https://www.ssllabs.com/ssltest and put in your url
in the Configuration section of the report it will list the TLS versions supported. 
-
I also just found this little one liner that will tell you what versions are available on your server
openssl ciphers -v | awk '{print $2}' | sort | uniqbut it seems to print all those available and not only those enabled. the machine in the image above that has only 1.2 enabled gave this result$ openssl ciphers -v | awk '{print $2}' | sort | uniqSSLv3 TLSv1 TLSv1.2– ericGJan 27, 2018 at 4:22 -
When CiviCRM is making a request to Authorize.net (transaction setup & submission), it's PHP that requires support for TLS v1.2. When Authorize.net is making a request to CiviCRM (eg IPN), it's your webserver (or SSL terminator) that requires TLS v1.2. The SSLLabs test covers only the second of those scenarios; the former can be found in the output of
phpinfo()orphp -i | grep -i tls. For most servers these will be the same (in which case theopenssltest is fine), but you really want to be checking the CiviCRM-to-Authorize.net route IMO. Or just run a test transaction 😀 Jan 29, 2018 at 8:02 -