Views:

Understanding TLS Support and Cipher Verification for Authorize.net

This article explains which Transport Layer Security (TLS) versions Authorize.net supports, how to verify the ciphers in use on your Authorize.net connection, how to confirm the ciphers used by your own site or solution, and the best practices and required actions based on your integration method. It is intended for merchants, developers, and solution providers who connect to Authorize.net and need to ensure their configuration meets current security standards.

Supported TLS Versions

  • TLS 1.2: Supported
  • TLS 1.3: Supported (only for Portals; Application Programming Interface (API) support will be added in the future)

Verifying Which Cipher Is Being Used by Authorize.net

Running an SSL Labs Report

  1. Visiting SSL Labs and running a report on the specific API endpoint or environment you are using.
  2. Reviewing the detailed list of supported TLS versions and ciphers provided in the report.

Using Command-Line Tools

  • OpenSSL: openssl s_client -connect secure.authorize.net:443 -tls1_2
  • Nmap: nmap --script ssl-enum-ciphers -p 443 secure.authorize.net

Using Browser Developer Tools

  1. Opening your browser's developer tools (typically by pressing F12 or right-clicking and selecting Inspect).
  2. Navigating to the Security or Network tab to view detailed information about the TLS connection and cipher used.

API Endpoints and Environments

Transact - Name Value Pair API

  • Production: secure.authorize.net, secure2.authorize.net
  • Sandbox: test.authorize.net

Authorize.net API

  • Production: api.authorize.net, api2.authorize.net
  • Sandbox: apitest.authorize.net

Verifying Which Cipher Your Site or Solution Is Using

Reach out to your developer or solution/software provider to confirm the current configuration of your site or application and for details on the ciphers and protocols enabled on your site or server/host.

Suggested Actions with Your Developer or Solution Provider

  1. Working with your provider to run tests using tools such as OpenSSL, Nmap, or online services to verify the actual ciphers in use.
  2. Reviewing your server configuration.
  3. Using command-line tools to check TLS and cipher support:
    • OpenSSL: openssl s_client -connect yourdomain.com:443 -tls1_2
    • Nmap: nmap --script ssl-enum-ciphers -p 443 yourdomain.com
  4. Using online tools to check TLS and cipher support by visiting SSL Labs and running a test on your domain to receive a detailed report on supported ciphers and protocols.

Best Practices for TLS Connections

  • Using TLS 1.2 or TLS 1.3: Earlier versions are not supported.
  • Preferred configurations:
    • Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) Galois/Counter Mode (GCM) ciphers
    • Perfect Forward Secrecy (PFS) cipher suites (preferred but not required)
    • Keyed hash functions with Secure Hash Algorithm 2 (SHA-2) or Secure Hash Algorithm 3 (SHA-3); Secure Hash Algorithm 1 (SHA-1) is not allowed
    • Authenticated encryption modes (for example, Advanced Encryption Standard Galois/Counter Mode (AES GCM), ChaCha20-Poly1305)

Actions Required Based on Processing Method

Using API or Software Development Kit (SDK) Integration

  1. Confirming with your developer or host that TLS 1.2 is used and that supported ciphers are configured.
  2. Updating your SDK by pulling the latest version from GitHub.
  3. Verifying configuration using tools such as How's My SSL or SSL Labs Test.

Using Hosted Payment Form Solutions (Simple Checkout or Invoicing)

  1. Making no changes to your integration.
  2. Ensuring customers use up-to-date browsers.

Using the Merchant or Partner Interface

  1. Upgrading your browser to a version that supports TLS 1.2.
  2. Testing your browser using SSL Labs Test or How's My SSL.
  3. Referencing the list of supported browsers provided by SSL Labs.

Common Questions

  • Which TLS versions does Authorize.net currently support?
    • Authorize.net supports TLS 1.2. TLS 1.3 is supported only for Portals, with API support planned for the future.
  • How can you confirm which cipher your Authorize.net connection is using?
    • You can run an SSL Labs report against the API endpoint you use, run command-line tests using OpenSSL or Nmap, or inspect connection details using your browser's developer tools.
  • How do you verify which ciphers your own site or software is using?
    • Contact your developer or solution provider to review server configuration and run tests using OpenSSL, Nmap, or SSL Labs to confirm which ciphers and protocols are enabled.
  • What cipher configurations are preferred for Authorize.net connections?
    • Preferred configurations include ECDHE GCM ciphers, PFS cipher suites, keyed hash functions using SHA-2 or SHA-3, and authenticated encryption modes such as AES GCM or ChaCha20-Poly1305. SHA-1 is not allowed.
  • What action is needed if you use an API or SDK integration?
    • Confirm with your developer or host that TLS 1.2 is enabled with supported ciphers, pull the latest SDK from GitHub, and verify your setup using How's My SSL or SSL Labs Test.
  • What action is needed if you use a hosted payment form (Simple Checkout or Invoicing)?
    • No changes are needed on your side. Ensure your customers use up-to-date browsers.
  • What action is needed if you access the Merchant or Partner Interface?
    • Upgrade your browser to a version that supports TLS 1.2 and validate compatibility using SSL Labs Test or How's My SSL.

Glossary

  • AES GCM: Advanced Encryption Standard Galois/Counter Mode
  • API: Application Programming Interface
  • ECDHE: Elliptic Curve Diffie-Hellman Ephemeral
  • GCM: Galois/Counter Mode
  • PFS: Perfect Forward Secrecy
  • SDK: Software Development Kit
  • SHA-1: Secure Hash Algorithm 1
  • SHA-2: Secure Hash Algorithm 2
  • SHA-3: Secure Hash Algorithm 3
  • SSL: Secure Sockets Layer
  • TLS: Transport Layer Security

Additional Resources