troubleshooting Question

Disabled SSLv2 and SSLv3 but Wireshark is still showing attempted SSL connections to Authorize.net

Avatar of Vas
VasFlag for United States of America asked on
Microsoft IIS Web ServerSSL / HTTPSWindows Server 2008
4 Comments1 Solution1749 ViewsLast Modified:
With the POODLE vulnerability, credit card gateway Authorize.NET has disabled support for SSLv3/SSLv2 and is requiring TLS to be used to connect to their service.

I'm running into an odd issue however.   I have two web servers, both running the same web ecommerce application (Lagarde Storefront 6.8.0.3), our developer is adamant that the exact same code is running on both web servers (each site just has a different domain name)

Both servers have SSLv2 and SSLv3 disabled, and this is confirmed by https://www.poodlescan.com/

This is also confirmed by the registry:

SSL3 client
SSL3 server

However, one site cannot process credit card transactions (Authorize.net is refusing or closing the connection), and I have confirmed different behavior via Wireshark.

One server is trying to connect using SSL v3,   while the working server is using TLS:


SSLv3
TLS



If the code is identical on both servers as the developer claims,  and SSL v2 and SSL v3 is confirmed DISABLED on both servers, what could it possibly be on the one server that is trying to use SSL to connect?  (if not the web application code)


The working server (using TLS) is running WIndows Server 2003 and the server trying to connect using SSL is a Server 2008 R2 server.


Any ideas what else I can check (server-side) that may be contributing to the connection attempting SSL rather than TLS?


Thanks
ASKER CERTIFIED SOLUTION
David Johnson, CD
The More I know, the more I don't know
Join our community to see this answer!
Unlock 1 Answer and 4 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 4 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros