Overview
Due to changes in security, it may be necessary to update a site to use TLS 1.2 for outbound connections, most notably to a payment gateway.
Please note this only affects outbound connections your site makes to other services. It is not related to an SSL certificate installed for the site, which covers inbound connections from visitors.
ASP.NET
The requirements for TLS 1.2 support when using ASP.NET are ASP.NET Framework 4.5 or higher, and bootstrapping code to set the TLS version. If a site is using an ASP.NET Framework older than 4.5 it will need to be updated.
Note that this is a project update rather than the ASP.NET Framework version set in the Everleap Control Panel. The Control Panel dropdown offers only two choices, 2.0/3.5 and 4.x. Selecting 4.x covers 4.5 and above at the server, but the target framework your project is built against is set in your project, not here.
To set the TLS version for an outbound connection, add the following to the script making the connection or to the global.asax:
System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12
More information regarding the last update can be found at https://stackoverflow.com/q/28286086.
Also note that the bootstrapping code would have to be updated if TLS requirements were to change in the future.
PHP / cURL
For PHP, TLS 1.2 support is dependent on the version of PHP set for the site. Every PHP version currently offered in the Control Panel supports TLS 1.2, so if your site is on one of them no change is needed.
To check or change the version:
- Log in to the Everleap Control Panel at cp.everleap.com.
- From the top menu click Shared Sites.
- On the Shared Cloud Sites Overview page, click Manage next to the applicable site.
- On the Site Overview page, click the SETTINGS tab.
- Click the General tab and check the PHP dropdown.
- If you change it, click Update General Settings.
If your site is still running a PHP version that is no longer offered in the list, that version predates reliable TLS 1.2 support and the site should be moved up.
To test TLS 1.2, the script in zcurl.zip may be used.
Verify it worked
Run the zcurl script from the site and confirm it reports a successful TLS 1.2 connection. If you are chasing a specific payment gateway failure, retry the transaction that was failing rather than relying on the test script alone, since gateways often require a particular cipher as well as a particular protocol version.
Notes
- Changing the PHP version affects the whole site. Test the site after changing it, not just the outbound connection.
- A site can be left on an older PHP version indefinitely, but it will keep that version only for as long as it stays selected. Once you move it up, the older version is no longer available to move back to.
Related Articles