Why Does ZeroBounce Only Support TLS 1.2 and Above?
The PCI Security Council is the body responsible for creating and enforcing rules on which technologies are acceptable for use in transmitting cardholder payment data. As such, they've explicitly identified that TLS 1.0 is no longer an adequate form of data encryption as it is vulnerable to many known attack methods. Due to this, ZeroBounce no longer supports TLS 1.0 and 1.1.
ZeroBounce joins the company of most company websites in adapting to the latest versions of TLS for better customer security and privacy.
Am I affected by the TLS change?
If you are not a ZeroBounce API user, it's doubtful that the change will affect you. There may be a few outlying scenarios if you operate on an old, outdated browser or operating system.
To determine if your current operating system or browser supports TLS 1.2 or higher, test your system for free courtesy of Qualys SSL Labs.
If you are a ZeroBounce API user and have any code that connects with any API endpoint, you'll need to ensure that it will continue to work. Every programming language and API library is different, so your mileage may vary.
Which programming languages are impacted by TLS changes?
The languages listed below will require significant changes or upgrades to support TLS 1.2 or higher:
- Java 6u45/7u45
- .NET before 4.5 (does not support TLS 1.2)
- .NET 4.5 (must update settings to enable TLS 1.2)
- OpenSSL 0.9.8
- Most dynamic languages, including Ruby, PHP, and Python - All of these rely on the underlying operating system's OpenSSL version. Check it by running OpenSSL (version 1.0.1 minimum required)
- Anything older than PHP 5.5.19 is outdated - Upgrade to 5.5.19 or higher for TLS 1.2 support)
Please be advised - ZeroBounce doesn't have experts for every programming language or framework. You'll need to test and update your code as needed to support the ZeroBounce API.
Other language-specific instructions
Below, you can find some additional instructions for various versions of .NET:
- .NET 4.6 - TLS 1.2 is automatic. No changes are necessary.
- .NET 4.5 - Update the 'SecurityProtocolType' to Tls12 using the SecurityProtocol Setter.
- .NET 4.0 - TLS 1.2 is supported, but there's no named 'SecurityProtocolType' enumeration for it. Instead, use (SecurityProtocolType)3072.
- .NET 3 and older - Please upgrade to .NET 4.5 or higher
Please refer to Microsoft's developer guidance for more support for TLS System Default Versions included in .NET.
Which browsers support TLS 1.2 and higher?
All modern browsers now support TLS 1.2 and higher. You will only experience an impact if you're using an outdated version of a web browser.
The following web browsers do not support TLS 1.2:
- Google Chrome 29
- Firefox 26
- Internet Explorer 10
- Safari 8
- iOS 4
- Android 4
If you're using one of these browsers or older versions, consider upgrading as soon as possible to support TLS 1.2 and higher for better payment security.