TLS1.2 for ColdFusion 9 and Older

The upcoming Authorize.NET switch to using TLS 1.2 only has a lot of people scrambling to get their servers updated. This has been a long planned transition at Authorize.NET and at many/most/all other payment processing companies. The inevitable facts are that TLS 1.0 and TLS 1.1 are outdated and they are going away. At CF Webtools we have been preparing for this inevitable day for the past few years.

ColdFusion 9.0.n is not tested to work on Java 1.8 and I have had cases were certain features of ColdFusion 9 did not work with Java 1.8. I have not tried any older versions of ColdFusion on Java 1.8 and I'm not going to. Adobe has not certified any versions of ColdFusion older than version 10 Update 14 (or ColdFusion 11 Update 2 and older). All of that being said, there is a workaround that uses a 3rd party commercial solution to make TLS 1.2 connections from ColdFusion 9. It works well, but I do not recommend that as a long term solution. The preferred long term solution is upgrading the server(s) and ColdFusion version to currently supported versions. This way there will be security updates to help protect against new threats. The commercial third-party CFX tag will require recoding the CFHTTP calls for the new CFX tag. The tag is CFX_HTTP5 and it is available here.

Follow the installation instructions that comes with the download and then you will have to recode your CFHTTP calls similar to the examples below. The code examples are for the older Authorize.NET Advanced Integration Method (AIM) API calls that you are most likely using in your older ColdFusion CFHTTP calls.

view plain print about
1<cfset authURL = "https://test.authorize.net/gateway/transact.dll" />
2 <cfif AuthNetMode eq "live">
3 <cfset authURL = "https://secure.authorize.net/gateway/transact.dll" />
4 </cfif>
5
6<!--- CFHTTP Call - Your code might look something like this --->
7<cfhttp url="#authURL#" method="post" result="cfhttp">
8 <cfhttpparam type="FORMFIELD" name="x_Login" value="#AuthLogin#">
9 <cfhttpparam type="FORMFIELD" name="x_Password" value="#AuthPassword#">
10 <cfhttpparam type="FORMFIELD" name="x_merchant_email" value="#AuthEmail#">
11 <cfhttpparam type="FORMFIELD" name="x_delim_data" value="true">
12 <cfhttpparam type="FORMFIELD" name="x_test_request" value="#x_test_request#">
13
14 <!--- we're using AUTH_ONLY so the card isn't charged until the order is processed --->
15 <cfhttpparam type="FORMFIELD" name="x_type" value="AUTH_ONLY">
16 <cfhttpparam type="FORMFIELD" name="x_method" value="cc">
17
18 <cfhttpparam type="FORMFIELD" name="x_amount" value="#orderTotal#">
19 <cfhttpparam type="FORMFIELD" name="x_card_num" value="#cardNumber#">
20 <cfhttpparam type="FORMFIELD" name="x_exp_date" value="#cardExpiration#">
21 <cfif isDefined("cardSecurityCode") and cardSecurityCode eq "">
22 <cfhttpparam type="FORMFIELD" name="x_card_code" value="#cardSecurityCode#">
23 </cfif>
24
25 <!--- If you want an email to go to the customer via authorize.net
26change this to true. Make sure authorize.net is configured properly. --->

27 <cfhttpparam type="FORMFIELD" name="x_email_customer" value="#x_email_customer#">
28
29 <cfhttpparam type="FORMFIELD" name="x_first_name" value="#billingFirstName#">
30 <cfhttpparam type="FORMFIELD" name="x_last_name" value="#billingLastName#">
31 <cfhttpparam type="FORMFIELD" name="x_company" value="#billingCompany#">
32 <cfhttpparam type="FORMFIELD" name="x_address" value="#billingAddress#">
33 <cfhttpparam type="FORMFIELD" name="x_city" value="#billingCity#">
34 <cfhttpparam type="FORMFIELD" name="x_state" value="#billingState#">
35 <cfhttpparam type="FORMFIELD" name="x_zip" value="#billingZip#">
36 <cfhttpparam type="FORMFIELD" name="x_country" value="#billingCountry#">
37
38 <cfhttpparam type="FORMFIELD" name="x_customer_ip" value="#cgi.remote_address#">
39 <cfhttpparam type="FORMFIELD" name="x_Email" value="#billingEmail#">
40 <cfhttpparam type="FORMFIELD" name="x_Phone" value="#billingPhone#">
41
42 <cfhttpparam type="FORMFIELD" name="x_ship_to_first_name" value="#shippingFirstName#">
43 <cfhttpparam type="FORMFIELD" name="x_ship_to_last_name" value="#shippingLastName#">
44 <cfhttpparam type="FORMFIELD" name="x_ship_to_company" value="#shippingCompany#">
45 <cfhttpparam type="FORMFIELD" name="x_ship_to_address" value="#shippingAddress#">
46 <cfhttpparam type="FORMFIELD" name="x_ship_to_city" value="#shippingCity#">
47 <cfhttpparam type="FORMFIELD" name="x_ship_to_state" value="#shippingState#">
48 <cfhttpparam type="FORMFIELD" name="x_ship_to_zip" value="#shippingZip#">
49 <cfhttpparam type="FORMFIELD" name="x_ship_to_country" value="#shippingCountry#">
50 <cfhttpparam type="FORMFIELD" name="x_Description" value="#description#">
51 <cfhttpparam type="FORMFIELD" name="x_invoice_num" value="#invoicenum#">
52 </cfhttp>
53
54 <cfset response = cfhttp.fileContent>

To refactor your code you will want to do something like this.

view plain print about
1<cfset authURL = "https://test.authorize.net/gateway/transact.dll" />
2 <cfif AuthNetMode eq "live">
3 <cfset authURL = "https://secure.authorize.net/gateway/transact.dll" />
4 </cfif>
5<!--- CFX_HTTP5 Call - You'll want to refactor your code in this fashion --->
6
7<cfset httpBody = "x_Login=#AuthLogin#&
8 x_Password=#AuthPassword#&
9 x_merchant_email=#AuthEmail#&
10 x_delim_data=true&
11 x_test_request=#x_test_request#&
12 x_type=AUTH_ONLY&
13 x_method=cc&
14 x_amount=#orderTotal#&
15 x_card_num=#cardNumber#&
16 x_exp_date=#cardExpiration#&
17 x_first_name=#billingFirstName#&
18 x_last_name=#billingLastName#&
19 x_company=#billingCompany#&
20 x_address=#billingAddress#&
21 x_city=#billingCity#&
22 x_state=#billingState#&
23 x_zip=#billingZip#&
24 x_country=#billingCountry#&
25 x_customer_ip=#cgi.remote_address#&
26 x_Email=#billingEmail#&
27 x_Phone=#billingPhone#&
28 x_ship_to_first_name=#shippingFirstName#&
29 x_ship_to_last_name=#shippingLastName#&
30 x_ship_to_company=#shippingCompany#&
31 x_ship_to_address=#shippingAddress#&
32 x_ship_to_city=#shippingCity#&
33 x_ship_to_state=#shippingState#&
34 x_ship_to_zip=#shippingZip#&
35 x_ship_to_country=#shippingCountry#&
36 x_Description=#description#&
37 x_invoice_num=#invoicenum#"
>

38
39 <!--- If you want an email to go to the customer via authorize.net
40change this to true. Make sure authorize.net is configured properly. --->

41 <cfset httpBody = httpBody & "&x_email_customer=#x_email_customer#">
42
43 <cfif isDefined("cardSecurityCode") and cardSecurityCode neq "">
44 <cfset httpBody = httpBody & "&x_card_code=#cardSecurityCode#">
45 </cfif>
46
47 <cfset cfxhttp = {}>
48 <cfset headers = "Content-Type: application/x-www-form-urlencoded">
49 <cfx_http5 url="#authURL#" method="post" out="cfxhttp.body" outqhead="cfxhttp.QHEAD" outhead="cfxhttp.RHEAD" ssl="5" body="#httpBody#" header="#headers#">
50 </cfx_http5>
51
52 <cfset response = cfxhttp.body>

The code is a minor change and relatively easy to do. I've tested this method in a production environment and it works fine. I do not recommend this as a long term solution. The preferred long term solution is upgrading the server(s) and ColdFusion version to currently supported versions. This way there will be security updates to help protect against new threats. If you are on ColdFusion 10 or 11 then the best option is to install the ColdFusion patches and upgrade the Java version to 1.8 then you will be good to go. If you need an experience ColdFusion developer to make these changes then please do contact us, we will be happy to assist.

The CFX_HTTP5 tag uses WinHTTP which is a built into Windows PROXY server. Here is where part of the problem exists. Microsoft didn't update WinHTTP on Windows 2008 Standard SP2. They've only updated it for Windows 2008 R2 and up. See this update (https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1-1-and-tls-1-2-as-a-default-secure-protocols-in). This leaves us not being able to use CFX_HTTP5 on Windows 2008 Standard and older.

This is one more friendly reminder to make sure your ColdFusion servers are patched! Either patch them yourself, have your hosting provider patch them. If you need help upgrading your VM or patching your server (or anything else) our operations group is standing by 24/7 - give us a call at 402-408-3733, or send a note to operations at cfwebtools.com.

CAVEATS:

  • This fix will not work for Windows 2003 Server, for any version of ColdFusion, as there is no support from Microsoft for TLS 1.1 or 1.2 in this server version.
  • This fix will not work for Windows 2008 Standard Server (not R2), for ColdFusion 9.0.n and older, as there is no support from Microsoft for TLS 1.1 or 1.2 for WinHTTP in this server version.

Authorize.NET Temporarily Ending TLS 1.1 and TLS 1.0 Support, is your ColdFusion Server Ready?

At CF Webtools we have been preparing for this inevitable day for the past few years. We've been upgrading our clients servers and services to handle TLS 1.2 calls to Authorize.Net and other third party processors for a while now. Recently Authorize.Net announced a "Temporary Disablement of TLS 1.0/1.1" for "a few hours on January 30, 2018 and then again on February 8, 2018." This is in preparation for the final disablement of TLS1.0/1.1 on February 28, 2018.

As you may be aware, new PCI DSS requirements state that all payment systems must disable earlier versions of TLS protocols. These older protocols, TLS 1.0 and TLS 1.1, are highly vulnerable to security breaches and will be disabled by Authorize.Net on February 28, 2018.

To help you identify if you're using one of the older TLS protocols, Authorize.Net will temporarily disable those connections for a few hours on January 30, 2018 and then again on February 8, 2018.

Based on the API connection you are using, on either one of these two days you will not be able to process transactions for a short period of time. If you don't know which API you're using, your solution provider or development partner might be a good resource to help identify it. This disablement will occur on one of the following dates and time:

  • Akamai-enabled API connections will occur on January 30, 2018 between 9:00 AM and 1:00 PM Pacific time.
  • All other API connections will occur on February 8, 2018 between 11:00 AM and 1:00 PM Pacific time.
Merchants using TLS 1.2 by these dates will not be affected by the temporary disablement. We strongly recommend that connections still using TLS 1.0 or TLS 1.1 be updated as soon as possible to the stronger TLS 1.2 protocol.

This means that if you are using older methods to make calls to Authorize.Net that are not capable of making TLS 1.2 connections then you will NOT be able to process credit card transactions.

This affects ALL ColdFusion versions 9.0.2 and older! This also affects ColdFusion 10 Update 17 and older. If your server is running any of these older versions of ColdFusion and your server is processing credit cards with Authorize.Net then this advisory applies to your server.

CF Webtools has been successfully mitigating this issue for clients servers for the past couple years and we are very experienced in resolving these security related issues. In a previous blog post I tested which TLS levels were supported by various ColdFusion versions on various Java versions and produced an easy to read chart.

If your ColdFusion server is affected by this or if you do not know if your ColdFusion server is affected by this then please contact us (much) sooner than later. Our operations group is standing by 24/7 - give us a call at 402-408-3733, or send a note to operations at cfwebtools.com.