Classic ASP Website and POODLE

I need some help with POODLE.

I have followed instructions on setting my server up so that it will not use SSL 3.0 by changing the registry and testing it.

My issue is that Authorize.Net says I need to make sure that my shopping cart will not be affected when processing credit card transactions.

My cart is written in classic ASP and uses Server.CreateObject ("MSXML2.ServerXMLHTTP.4.0") to send the request to Authorize.NET for credit card processing.

How do I evaluate my solution to see if it will be a problem?

Thanks!
GenesisTechAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
I received the same email today.  They are talking about the browser and it will only affect people using older IE browsers like ie6 from my understanding.
0
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
The copy of that email looks like it is from http://www.authorize.net/support/poodlefaqs/#whattodo 

Microsoft is saying there will be an update https://technet.microsoft.com/en-us/library/security/3009008.aspx

Are you using shared hosting or dedicated/vps?
0
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
There is some good answers about server specifics answered http://www.experts-exchange.com/Networking/Protocols/SSL/Q_28539415.html

I have also asked some others for input.
0
Defend Against the Q2 Top Security Threats

Were you aware that overall malware worldwide was down a surprising 42% from Q1'18? Every quarter, the WatchGuard Threat Lab releases an Internet Security Report that analyzes the top threat trends impacting companies worldwide. Learn more by viewing our on-demand webinar today!

GenesisTechAuthor Commented:
I have a dedicated server.
0
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
That link I gave you from MS outlines how to disable sslv3   https://technet.microsoft.com/en-us/library/security/3009008.aspx

Disable SSL 3.0 in Windows
For Server Software
You can disable support for the SSL 3.0 protocol on Windows by following these steps:
Click Start, click Run, type regedt32 or type regedit, and then click OK.
In Registry Editor, locate the following registry key:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
On the Edit menu, click Add Value.
In the Data Type list, click DWORD.
In the Value Name box, type Enabled, and then click OK. 
Note If this value is present, double-click the value to edit its current value.
In the Edit DWORD (32-bit) Value dialog box, type 0 .
Click OK. Restart the computer.
 
Note This workaround will disable SSL 3.0 for all server software installed on a system, including IIS.

Note After applying this workaround, clients that rely only on SSL 3.0 will not be able to communicate with the server.
 
For Client Software
You can disable support for the SSL 3.0 protocol on Windows by following these steps:
Click Start, click Run, type regedt32 or type regedit, and then click OK.
In Registry Editor, locate the following registry key:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client
Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
On the Edit menu, click Add Value.
In the Data Type list, click DWORD.
In the Value Name box, type Enabled, and then click OK. 
Note If this value is present, double-click the value to edit its current value.
In the Edit DWORD (32-bit) Value dialog box, type 0 .
Click OK. Restart the computer.
 
Note This workaround will disable SSL 3.0 for all client software installed on a system.

Note After applying this workaround, client applications on this machine will not be able to communicate with other servers that only support SSL 3.0.

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
GenesisTechAuthor Commented:
Scott and others.

I have followed the link's instructions and I get that already. My understanding is that the link refers to handling INBOUND web requests and how my server will respond to them.

My concern has to do with OUTBOUND payment processing requests. Authorize.NET specifically states that you need to make sure your Shopping Cart software will not have a problem submitting and processing a transaction request to Authorize.NET. How do I determine what protocol my shopping cart uses when sending out the request and whether it will work with Authorize.NET or not?
0
GaryCommented:
No points for this as Scott has already answered it.
All you need do is disable SSLv3 on your server - end of, nothing else to do, carry on with your life.
0
Scott Fell, EE MVEDeveloper & EE ModeratorCommented:
If SSLv3 is not available on the server, it can't be used.  

I didn't have to do anything for my own server. Check this out for your own
https://www.ssllabs.com/ssltest/index.html
0
GenesisTechAuthor Commented:
OK. I appreciate the help.

I guess I was confused because Authorize.NET made it sound like there were 2 very distinct actions that needed to be taken.
1) To make sure your server no longer supported SSL3 for incoming requests....AND
2) To make sure your transaction processing request being sent to Authorize.NET would be in compliance as well.

If fixing the server fixes both for me, than I guess I am all set.

Thanks guys!!!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SSL / HTTPS

From novice to tech pro — start learning today.