SmartDebit warning about disabling TLS 1.0 and 1.1
SmartDebit recently sent an email warning about TLS 1.0 and 1.1 being disabled. With this issue I aim to document any possible impact in the extension. The message is copied below.
We are writing to notify you that SmartDebit will be disabling support for TLS v1.0 & v1.1 across all of our public facing applications:
Wednesday, 1 September 2021 00:00
We are providing all our customers and partners with advance notice so that you can prepare accordingly. From 1 September 2021, if you attempt to make connections to our sites using TLS v1.0 or TLS v1.1, you will receive connection error messages instead of being able to connect.
Affected services include:
- SmartDebit Pulse
- SmartDebit Online
- SmartDebit Direct
- SmartDebit API
- HTTPS component of our SecureFTP file upload service
What is TLS?
Transport Layer Security (TLS) is the successor protocol to SSL. TLS is an improved version of SSL. It works in much the same way as the SSL, using encryption to protect the transfer of data and information.
Why are we disabling TLS v1.0 and TLS v1.1?
We are disabling TLS v1.0 and TLS v1.1 to ensure that SmartDebit customers are provided with only the safest, most secure protocols. The deprecation of these older protocols has been ongoing worldwide over the last few years. While SmartDebit (along with many other financial institutions) have provided support for legacy customers still using these insecure protocols for as long as possible, we can no longer do so. The only protocols currently regarded as being completely secure are TLS versions 1.2 and 1.3 and, from 1 September, these will be the only protocols supported by SmartDebit.
Am I affected?
Web browser
We are seeing very few connections overall using these protocols. If you are using a modern browser version to connect to SmartDebit’s services, you have little reason for concern. Your connection to our services will be unaffected and there is no need for you to take any action in preparation for this change. All current versions of the most popular browsers already support the latest TLS versions. You can confirm the capabilities of your browser by visiting the following site:
API
We are still seeing some connections using TLS v1.0 on our API service. If needed, you can use the following third party API to test the library you are using to determine whether your client supports TLS v1.2 or better.
- https://go.pardot.com/e/499121/a-check/33bhz9/572836312?h=MlQfWyuzZfhrUtK2NJr05n9uLO7RsN0dNhx6jmS-vqE
- Reference: https://go.pardot.com/e/499121/s-api-html/33bhzc/572836312?h=MlQfWyuzZfhrUtK2NJr05n9uLO7RsN0dNhx6jmS-vqE
- The HTTP response will contain a ‘tls_version’ value which contains the highest version of TLS that is supported by the client.
Note: this service is not affiliated with SmartDebit in any way, nor is it hosted by us. It is a completely independent test service intended as a simple test of your API clients' capabilities. We cannot guarantee its results and provide it as a potentially helpful resource should you have the need.
Although we are seeing, overall, very little traffic using these older protocols, we encourage all our customers and partners to ensure they are ready for this change and to reach out to us should you have any questions or concerns regarding this change.
Customer Support
We apologise in advance for any inconvenience this might cause.
If you have any questions relating to this notification, please contact our Customer Service team (available from 09:00 - 17:30 Monday to Thursday, and 09:00 - 17:00 Friday).
- Live Chat on Pulse
- Email support@smartdebit.com
- Telephone 01276 851820