1

I got a notice today that Authorize.net is going to shut off their SSLv3 protocol on November 4 (7 days from today) in response to the POODLE threat. I'm using Drupal Commerce's commerce_authnet module to accept credit cards on our web storefront, how can I tell whether I connect via SSLv3? And if I do, how can I change that to connect via TLS or whatever I need to do?

Thanks.

Improve this question

1 Answer 1

Reset to default
7

The commerce_authnet module is using the PHP curl() functions to communicate with Authorize.net, and it does not explicitly requests the SSLv3 protocol in the curl options (see file commerce_authnet.module, lines 1163 to 1172).

curl will therefore rely on the HTTPS handshake to determine the protocols and ciphers, and since the Authorize.net will not advertise SSLv3, another protocol will be selected during the handshake (most certainly TLS v1.2).

So you have nothing to change, the transition will be handled automatically by the HTTPS handshake. I would only advise you to upgrade your openssl library to the latest version.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.