Tue 07.07.2020.

OPEN PLATFORM - RESCHEDULED Action Required: Disabling of Weak TLS, scheduled 1 year ago

Please be advised that the disabling of weak cipher suites on the OPEN Payments Gateway has been rescheduled, and will now take place on July 27, 2020. As a reminder, this change may require action from your organization to prevent disruption to service.

We have extended this deadline to provide greater flexibility to customers who have not yet been able to make this change. Please note that as these weak cipher suites do not meet PCI-DSS requirements, there will be no further extensions beyond this date.

Description: As part of our commitment to providing our customers with highly-secure, PCI-certified payment solutions, we will be disabling several weak TLS cipher suites for HTTPS connections to the OPEN Payments Gateway and associated tools, including the Merchant Portal (BIP). The list of TLS cipher suites being disabled is as follows:

  • ECDHE-RSA-AES256-SHA384 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  • DHE-RSA-AES256-SHA256 | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
  • DHE-RSA-AES128-SHA256 | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
  • ECDHE-RSA-AES256-SHA | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  • DHE-RSA-AES256-SHA | TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  • ECDHE-RSA-AES128-SHA | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  • DHE-RSA-AES128-SHA | TLS_DHE_RSA_WITH_AES_128_CBC_SHA

The full list of TLS cipher suites that will be available after this change can be found on our developer portal . Any Merchant or shopper who do not support at least one of the supported TLS cipher suites will no longer be able to connect to the Gateway after this change is deployed to production on July 6, 2020.

These changes have already been deployed to our customer TEST (staging) environment, and merchants are strongly recommended to test connectivity in the customer test environment prior to the production deployment to ensure that there will be no disruption to service as a result of this change.

  • Time Start: July 27, 2020 06:00 AM GMT
  • Time End: July 27, 2020 08:00 AM GMT
  • Impact: Any customers or shoppers who do not support at least one of the supported TLS cipher suites for HTTPS connections in the link above will not be able to connect to the OPEN Payments Gateway or Merchant Portal after this change. For customers who already support one or more of the available cipher suites, there will be no impact as a result of this change.
  • Affected Services: OPEN Gateway - Production Environment

For current system status and planned maintenances please check our status page at https://status.allsecpay.com