logo
Welcome to our new AbleCommerce forums. As a guest, you may view the information here. To post to this forum, you must have a registered account with us, either as a new user evaluating AbleCommerce or an existing user of the application. For all questions related to the older version of Gold and earlier, please go to AbleCommerce Gold forum. Please use your AbleCommerce username and password to Login. New Registrations are disabled.

Notification

Icon
Error
Older protocols - Are they really necessary
Options
Go to last post Go to first unread
Previous Topic Next Topic
charles25686713  
#1 Posted : Tuesday, June 20, 2023 11:59:59 AM(UTC)
charles25686713

Rank: Advanced Member

Groups: Authorized User, Developers
Joined: 7/1/2022(UTC)
Posts: 64

Thanks: 5 times
Was thanked: 1 time(s) in 1 post(s)
Hi Ray, re the ciphers, you should be able to safely disable them.

One of the steps I take for new servers, or server rebuilds, is check them on SSLLabs.com. I then go through the process of disabling TLS 1.0, 1.1, and older ciphers on 1.2, until I get at least an A on the server from SSLLabs.

I haven't received any complaints yet from customers, and it keeps the PCI guys happy. :)
Back to top

Wanna join the discussion?! Login to your AbleCommerce Forums forum account. New Registrations are disabled.
Back to top  
ray22901031  
#2 Posted : Tuesday, June 20, 2023 12:05:15 PM(UTC)
ray22901031

Rank: Advanced Member

Groups: Authorized User, Developers
Joined: 2/17/2019(UTC)
Posts: 827

Thanks: 3 times
Was thanked: 13 time(s) in 13 post(s)
Hi Charles,

Thank you very much for your reply. I kind of figured that, my main concern is the cookie settings. Waiting on support to acknowledge, I don't want to switch and mess up the forms in AbleCommerce.

The server is pretty much secure, with a heavy-duty hardware firewall, and then the software firewall by Cloudflare. Just want to make sure I don't miss anything, since I'm now going out on my own for hosting.

Thanks
Back to top
shaharyar  
#3 Posted : Wednesday, June 21, 2023 6:53:25 AM(UTC)
shaharyar

Rank: Advanced Member

Groups: Admin, Developers, Registered, HelpDesk, Authorized User
Joined: 10/5/2018(UTC)
Posts: 704

Thanks: 5 times
Was thanked: 113 time(s) in 112 post(s)
Quote:
#1. Is making the setting on the cookie secure as opposed to Lax in any way going to mess up the operation of Ablecommerce?


This is not going to mess up with the Ablecommerce functionalities.

There is also a setting in Admin - Configure - SSLSettings
Enable SSL Redirection
Select Secure all pages
Enable Use Secure Cookies
Back to top
ray22901031  
#4 Posted : Wednesday, June 21, 2023 7:43:38 AM(UTC)
ray22901031

Rank: Advanced Member

Groups: Authorized User, Developers
Joined: 2/17/2019(UTC)
Posts: 827

Thanks: 3 times
Was thanked: 13 time(s) in 13 post(s)
Thank you.

Furthermore, just want to make sure that AbleCommerce or any of its plug-ins don't rely on the older TLS 1.0 or 1.1 protocols, I am assuming it's safe to disable them?

Thanks
Back to top
Katie S  
#5 Posted : Wednesday, June 21, 2023 2:03:09 PM(UTC)
Katie S

Rank: Advanced Member

Groups: System, Administrators, Developers, Registered, HelpDesk
Joined: 10/29/2018(UTC)
Posts: 427

Thanks: 4 times
Was thanked: 34 time(s) in 33 post(s)
Yes. We’ve not utilized TLS 1.0, TLS 1.1 or weak cyphers for many years.

Thanks,
Thanks for your support!

Katie
Secure eCommerce Software and Hosting
Back to top
Users browsing this topic
Guest
Forum Jump  
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.

Privacy Policy | Powered by YAF.NET 2.2.4.14 | YAF.NET © 2003-2024, Yet Another Forum.NET
This page was generated in 0.178 seconds.