Paypal Merchant upgrade to TLS 1.2

[Digitalwork]

Blesta,

We currently have Blesta 3.6.2 and Paypal Payflow Pro + ACH (ver 1.2.1) gateway.  We got an email from Paypal that after performing Merchant Security Testing, we were impacted if they made the switchover to complete supporting only TLS 1.2 

Do we need to upgrade Blesta or the gateway plugin in order to accomplish this ?

 

Thanks. 

[Tyson]

Neither Blesta nor the gateway requires an update to support TLS 1.2. This is server-related. You should contact your hosting company and tell them you need them to support TLS 1.2.

[Paul]

2 minutes ago, Digitalwork said:

Gotchya.

I host it over digital ocean so i can definitely upgrade the droplet as needed. I will upgrade to Centos 6.9. 

I understand the OS piece, but does this have anything to do with the SSL Protocols that are being set in the webserver piece were Blesta is running ?

It doesn't have anything to do with Blesta specifically, but rather SSL/TLS on the server. There are 2 parts to it SSL/TLS in Apache (inbound requests) and SSL/TLS in PHP (outbound requests). CentOS 6 < 6.8 can do TLS 1.2 in Apache for inbound requests, but not outbound requests. This is why it's important to upgrade to 6.8 minimum. I think 6.9 is latest in that release, so that should be ok. No issues with CentOS 7.x

[Paul]

Also, just FYI in my experience if you're running CentOS, you will need CentOS 6.8 minimum. 7.x recommended.

[Digitalwork]

Gotchya.

I host it over digital ocean so i can definitely upgrade the droplet as needed. I will upgrade to Centos 6.9. 

I understand the OS piece, but does this have anything to do with the SSL Protocols that are being set in the webserver piece were Blesta is running ?

[Digitalwork]

Ahhh !!!

Now you are speaking my language !! Got it. Thank you very much kind sir

[gutterboy]

Is this the case for all Blesta version? We are still running 3.2.2.

Thanks!

[Michael]

2 hours ago, gutterboy said:

Is this the case for all Blesta version? We are still running 3.2.2.

Thanks!

Yes because it's a server issue.

[Paul]

6 hours ago, gutterboy said:

Is this the case for all Blesta version? We are still running 3.2.2.

Thanks!

I would highly suggest an upgrade!  But yes, it should work in the right server environment. If RHEL/CentOS, v6.8 MINIMUM.

[gutterboy]

Thanks - I understand it's a server issue, but I have read that it's possible to hardcode your code to using specific versions of TLS/http for example, so just checking to be safe