6

Today I started receiving the following exception when making callouts to external web services:

System.CalloutException: IO Exception: Server chose TLSv1, but that protocol version is not enabled or not supported by the client.

Why would this start failing?

When connecting to the same org using the Partner API from a client application that doesn't support TLS 1.1 or higher:

UNSUPPORTED_CLIENT: TLS 1.0 has been disabled in this organization. Please use TLS 1.1 or higher when connecting to Salesforce using https.

A POST request for Web-to-lead is intermittently coming back with:

400 Bad Request
StatusDescription: TLS 1.1 or higher required.

Improve this question

2 Answers 2

Reset to default
8

This corresponds to Salesforce disabling TLS 1.0. Pointing https://www.ssllabs.com/ssltest/ at the publicly accessible web services returns the following result:

TLS 1.1 and 1.2 support missing

As a short term fix while upgrading the web services to support newer versions of TLS, you might be able to deactivate the corresponding critical update:

Require TLS 1.1 or higher for HTTPS connections

Update Name

Require TLS 1.1 or higher for HTTPS connections

Update Summary

This update strengthens HTTPS connections to and from this organization by disabling the older TLS 1.0 protocol and requiring TLS 1.1 or higher in HTTPS connections.

Improve this answer
3
  • Hi Daniel, We are getting the same error in our fsandbox. But this feature is not enabled in the sandbox. Apparently it cannot be seen in the fsandbox under critical updates. However the feature is currently disabled in the production
    – L Mudiyanse
    Commented Jun 27, 2016 at 4:02
  • 2
    @Lahiru The screenshot above doesn't show it, but I believe Sandbox orgs have now been auto activated for the TLS 1.1+ requirement. Production orgs still have some time to run until they also auto activate.
    – Daniel Ballinger
    Commented Jun 27, 2016 at 8:07
  • 1
    Contact SFDC support if you need a sandbox or two rolled back to TLS1.0. Don't take the initial "no" for an answer, keep pushing if you need it. They have rolled back a couple of sandboxes for me.
    – krigi
    Commented Jul 8, 2016 at 4:52
1

For anyone who found themselves with this issue and is running Mac Server, upgrading to El Capitan and to the latest Server.app (5.1?) solved all of these issues for me. It updated the version of openssl (no higher than 0.9.8xx on previous OS X versions) to 1.0.2g which can handle TLS1.1 and TLS1.2.

For me, it broke our acceptance of Outbound Messages and our use of the Salesforce REST API.

What's more, it allows hidden folders to be served, a plus if you want to set up let's encrypt.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .