If your server does not support TLS 1.2 by June 30, 2017, you may not be able to process payments. Check your website analytics data to see how much of your traffic would be affected. Instead, they will receive an error message: “Internet Explorer cannot display the webpage.” With usage of those older versions quickly dwindling, this is becoming less of a concern. Turning off TLS 1.0 on your server will mean any users whose browsers do not support the new protocols will be unable to access “ pages on your website. IE 8-10 are capable of supporting TLS 1.1 and 1.2, on some operating systems, but the feature must be manually enabled. One of the primary reasons to delay (and the reason the original PCI deadline was pushed back) was that TLS 1.1 and 1.2 are not supported by default on Internet Explorer 10 or below. Right now you can get away with that given the right documentation, but you won’t be able to forever. You may have experienced your PCI Approved Scanning Vendor (ASV) scan already flagging your server for supporting the old protocols the original deadline was June 2016. Each payment provider’s sandbox environment already has the new protocols in place, which can be used to verify compliance.īut longer term, your own website needs to be compatible too: If you accept SSLv3 or TLS 1.0 connections beyond June 2018, your site will not be PCI-compliant. In the short term, your immediate concern is probably to ensure your website doesn’t break when your payment processor (PayPal, Braintree, Authorize.Net, etc.) stops supporting the older protocols.

That means if you use PayPal or Braintree with your eCommerce store, you must ensure your server supports TLS 1.2 in the next few weeks, or you risk being unable to process payments. Authorize.Net will be following suit and disabling everything below TLS 1.2 September 18, 2017. PayPal and Braintree will be requiring TLS 1.2 by June 30, 2017, and disabling all older protocols (SSL v3, TLS 1.0, and TLS 1.1).

“But that’s a year away,” you’re saying “why should I care now?” Well, PCI recommends switching as soon as possible, and several major payment gateways are heeding this advice. The PCI Security Standards Council is requiring all payment processors and merchants to move to TLS 1.2 and above by June 30, 2018.

If you have a website that accepts online payments, this affects you.

Authorize.net test tls 1.2