Stripe won't work with lower than TLS 1.2, starting tomorrow

https://support.stripe.com/questions/how-do-i-upgrade-my-stripe-integration-from-tls-1-0-to-tls-1-2

by danschumann • 8 years ago

62 13 8 years ago

support.stripe.com

patio114• 8 years ago

(I work at Stripe.)

You might wonder "Hmm, is my Stripe integration affected?" (I sure did!) and the answer is "Almost certainly not." (We've been watching the number of users with outdated versions of TLS on a dashboard for the last several months and actively working on getting people migrated.)

If your integration was affected, it is likely you've gotten a few emails from us and also a notification in your Stripe dashboard. If you don't see a prominent banner when you log in (with additional detail in your Developer tab of the dashboard), you're probably good.

If you have any questions, email support@stripe.com ; we're happy to help.

drchiu• 8 years ago

Nice to hear Stripe being proactive before what is essentially functionality breaking changes. Kudos to you guys for having a page with instructions on testing it ourselves on production servers with small snippets of pre-written code.

patio114• 8 years ago

Thanks! We know that the infrastructure we build sits in really important parts of our customers' businesses and do our best to avoid both breaking changes and, especially, surprise breaking changes.

(A related topic: we go to fairly substantial efforts to support outdated API versions while still letting us build new features. Amber Feng had a great presentation on it back in the day: https://www.heavybit.com/library/video/move-fast-dont-break-... )

If working on these sort of problems at scale sounds interesting or if you like the idea of working on a team which really sweats the downstream impact of engineering changes, we're hiring and always happy to chat.

danschumann2• 8 years ago

We were tasked with upgrading a stripe integration for a client with really old PHP. On Friday, none of their transactions worked. We called stripe and they said, "Oh, we decided to upgrade some people early"... uhh.. yea. Eventually they rolled us back, and we finished the upgrade on Monday, but it was still really troubling.

patio114• 8 years ago

I'm sorry that happened. For clarity, was it related to this specifically? I'd like to look into what went wrong there.

snikch• 8 years ago

I feel like this is an incorrect, inflammatory title. New integrations will cease to work with TLS < 1.2. Existing integrations are fine.

ryanisnan• 8 years ago

Are you sure about that? It would appear that the library will raise an APIConnectionError, which may in turn do so based on the return code from Stripe's API.

jetru• 8 years ago

This is a requirement for PCI. So I'm sure all integrations will cease to work with older TLS.

fybe2• 8 years ago

Not necessarily as PCI requires a minimum of TLS 1.1 with 1.2 being the recommended. [0]

[0]https://blog.pcisecuritystandards.org/are-you-ready-for-30-j...

habitue• 8 years ago

No, they are definitely shutting off all TLS less than 1.2, it's required to keep PCI certification.

fybe2• 8 years ago

PCI requirements are TLS 1.1 minimum. Stripe's change is of course is due to PCI certification and 1.2 is strongly encouraged, but 1.2 is not the defacto version required. They could have just disabled 1.0 and keep 1.1. Just wanted to correct the info. (Also happy that they didn't take the minimum and took the extra effort to implement 1.2)

Source: https://blog.pcisecuritystandards.org/are-you-ready-for-30-j...

Stripe won't work with lower than TLS 1.2, starting tomorrow

Related Stories