Solved

Classic ASP Website and POODLE

Posted on 2014-10-29
10
864 Views
Last Modified: 2014-10-29
I need some help with POODLE.

I have followed instructions on setting my server up so that it will not use SSL 3.0 by changing the registry and testing it.

My issue is that Authorize.Net says I need to make sure that my shopping cart will not be affected when processing credit card transactions.

My cart is written in classic ASP and uses Server.CreateObject ("MSXML2.ServerXMLHTTP.4.0") to send the request to Authorize.NET for credit card processing.

How do I evaluate my solution to see if it will be a problem?

Thanks!
0
Comment
Question by:GenesisTech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
10 Comments
 
LVL 53

Expert Comment

by:Scott Fell, EE MVE
ID: 40411048
I received the same email today.  They are talking about the browser and it will only affect people using older IE browsers like ie6 from my understanding.
0
 
LVL 53

Expert Comment

by:Scott Fell, EE MVE
ID: 40411061
The copy of that email looks like it is from http://www.authorize.net/support/poodlefaqs/#whattodo 

Microsoft is saying there will be an update https://technet.microsoft.com/en-us/library/security/3009008.aspx

Are you using shared hosting or dedicated/vps?
0
 
LVL 53

Expert Comment

by:Scott Fell, EE MVE
ID: 40411101
There is some good answers about server specifics answered http://www.experts-exchange.com/Networking/Protocols/SSL/Q_28539415.html

I have also asked some others for input.
0
PeopleSoft Has Never Been Easier

PeopleSoft Adoption Made Smooth & Simple!

On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool.  Claim Your Free WalkMe Account Now

 

Author Comment

by:GenesisTech
ID: 40411282
I have a dedicated server.
0
 
LVL 53

Accepted Solution

by:
Scott Fell,  EE MVE earned 500 total points
ID: 40411312
That link I gave you from MS outlines how to disable sslv3   https://technet.microsoft.com/en-us/library/security/3009008.aspx

Disable SSL 3.0 in Windows
For Server Software
You can disable support for the SSL 3.0 protocol on Windows by following these steps:
Click Start, click Run, type regedt32 or type regedit, and then click OK.
In Registry Editor, locate the following registry key:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
On the Edit menu, click Add Value.
In the Data Type list, click DWORD.
In the Value Name box, type Enabled, and then click OK. 
Note If this value is present, double-click the value to edit its current value.
In the Edit DWORD (32-bit) Value dialog box, type 0 .
Click OK. Restart the computer.
 
Note This workaround will disable SSL 3.0 for all server software installed on a system, including IIS.

Note After applying this workaround, clients that rely only on SSL 3.0 will not be able to communicate with the server.
 
For Client Software
You can disable support for the SSL 3.0 protocol on Windows by following these steps:
Click Start, click Run, type regedt32 or type regedit, and then click OK.
In Registry Editor, locate the following registry key:
HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client
Note If the complete registry key path does not exist, you can create it by expanding the available keys and using the New -> Key option from the Edit menu.
On the Edit menu, click Add Value.
In the Data Type list, click DWORD.
In the Value Name box, type Enabled, and then click OK. 
Note If this value is present, double-click the value to edit its current value.
In the Edit DWORD (32-bit) Value dialog box, type 0 .
Click OK. Restart the computer.
 
Note This workaround will disable SSL 3.0 for all client software installed on a system.

Note After applying this workaround, client applications on this machine will not be able to communicate with other servers that only support SSL 3.0.

Open in new window

0
 

Author Comment

by:GenesisTech
ID: 40411507
Scott and others.

I have followed the link's instructions and I get that already. My understanding is that the link refers to handling INBOUND web requests and how my server will respond to them.

My concern has to do with OUTBOUND payment processing requests. Authorize.NET specifically states that you need to make sure your Shopping Cart software will not have a problem submitting and processing a transaction request to Authorize.NET. How do I determine what protocol my shopping cart uses when sending out the request and whether it will work with Authorize.NET or not?
0
 
LVL 58

Expert Comment

by:Gary
ID: 40411516
No points for this as Scott has already answered it.
All you need do is disable SSLv3 on your server - end of, nothing else to do, carry on with your life.
0
 
LVL 53

Assisted Solution

by:Scott Fell, EE MVE
Scott Fell,  EE MVE earned 500 total points
ID: 40411562
If SSLv3 is not available on the server, it can't be used.  

I didn't have to do anything for my own server. Check this out for your own
https://www.ssllabs.com/ssltest/index.html
0
 

Author Comment

by:GenesisTech
ID: 40411640
OK. I appreciate the help.

I guess I was confused because Authorize.NET made it sound like there were 2 very distinct actions that needed to be taken.
1) To make sure your server no longer supported SSL3 for incoming requests....AND
2) To make sure your transaction processing request being sent to Authorize.NET would be in compliance as well.

If fixing the server fixes both for me, than I guess I am all set.

Thanks guys!!!
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

SSL stands for “Secure Sockets Layer” and an SSL certificate is a critical component to keeping your website safe, secured, and compliant. Any ecommerce website must have an SSL certificate to ensure the safe handling of sensitive information like…
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

742 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question