Question

I recently received an email from Authorize.net saying:

During the week of March 16 – 20, 2009, Authorize.Net will be deprecating all legacy support for the SSL 2.0 protocol. Changes have recently been made to the Payment Card Industry Data Security Standard (PCI DSS) which have made the use of SSL 2.0 a PCI DSS violation.

So question is: how to make sure that my ColdFusion apps, using cfhttp to communicate with auth.net service, won’t become broken in March?

Trying to find out which versions of SSL supported but can not find such info.

Any suggestions?

EDIT

Found discussions: one & two. Seems that only reliable way is upgrading to CF8.

So, other quesiton now: how to test my code with new auth.net protocol? Any ways to switch dev env before going live?

Also I’ve sent email to dev support of auth.net with these questions. If they’ll provide me with solution — will post it here.

Answer 1

Okay, finally The Gods Have Spoken — Auth.net Developer replied:

We would recommend that each user verify their server SSL encryption protocol settings. If you are unsure where to find them a Google search of the server type along with SSL 3.0 should provide helpful information in this regard. Additionally, the server support resources should provide this information.

This change has been released to the test environment. You may use the following shared test account for testing purposes if you wish:

Login ID: xxxxxxxx

Password: xxxxxxxxx

Login URL: https://test.authorize.net

API Login ID: xxxxxxxx

Transaction Key: xxxxxxxxx

Post to URL: https://test.authorize.net/gateway/transact.dll

Note: this is new test account, but I think that all test accounts are changed now, will try to test.

At least, now I am able to test my transactions in sandbox before changes do live, that’s what I’ve wanted.