|
Von Nostrand
|
February 21, 2015 at 6:03 pm
Hi Guys
Just wondering if this will affect the EE NAB gateway? I just got an email concerning changes to NAB direct post which the gateway uses.
“we’re upgrading NAB Transact to only support TLS (Transport Layer Security) 1.0 (or higher) across all API (Application programming interface) connections and websites. This includes all web-based interfaces such as Direct Post and Pay by Web, and internet browsers connected to a NAB Transact login.
SSL (Secure Sockets Layer) 3.0 will no longer be used.”
many thanks
Von
|
|
Sidney Harrell
|
February 23, 2015 at 10:50 am
It should not affect EE at all. The EE NAB just tells the server to use https for the IPN validation. Assuming that your server is set up to be able to use TLS, it will use it to set up the https connection.
Same thing when EE submits the form to NAB. It tells the user’s browser to use https. The browser then negotiates a connection to NAB’s server, but whether that connection uses TLS or the older SSL 3.0 is really out of EE’s control. I think all modern browsers ask for a TLS connection first, and if the server that they are connecting to does not support TLS, it will downgrade to SSL 3.0, or whatever the server does support. I just checked it in my browser, and it says my https connection to transact.nab.com.au is using TLS 1.2. I would be surprised if your hosting server is not also already using TLS for it’s https connection to NAB’s server when it goes to validate the payment.
|
