4

This morning, our team arrived to find our sandbox instance in disarray. Salesforce had disabled TLS 1.0 across the entire instance, breaking our homegrown applications that communicate with it via APIs, as well as outbound connections to third parties (for things like account lookups). We've fixed our .NET applications -- it was actually pretty easy!

However, the APEX code we're using to do outbound SOAP calls to 3rd parties are still broken. In one instance, we have:

WebServiceCallout.invoke(
    this,
    request_x,
    response_map_x,
    new String[]{endpoint_x,
        'findCustAccts',
        'http://webservice.findcustaccts.CLIENT.com',
        'findCustAccts',
        'http://webservice.findcustaccts.CLIENT.com',
        'findCustAcctsResponse',
        'CLIENT_webserviceFindcustaccts.findCustAcctsResponse_element'}
);

Here's what it looks like in the log when I fire this off:

System.CalloutException: IO Exception: Server chose TLSv1, but that protocol version is not enabled or not supported by the client.

Nowhere in the documentation does it state how to 'force' a certain TLS level. What can we do to make these servers play nice?

Note: I have seen Callouts to web services started failing with CalloutException: Server chose TLSv1 and that does not solve this problem.

1 Answer 1

7

Unfortunately it is up to the external service to negotiate the connection and support tls 1.1

The general compatibility guidelines from the API (inbound) integrations (see section above) can be used to help achieve TLS 1.1 and later compatibility. However, since the technologies and vendors used to run the remote endpoints can vary, the teams that manage the endpoints will need to work to achieve TLS 1.1 or TLS 1.2 compatibility on the end points that they run.

https://help.salesforce.com/apex/HTViewSolution?id=000221207

4
  • But...shouldn't we be able to set the outbound handshake protocol to one that is supported? It seems like the industry standard is changing and we should be able to make outbound callouts using an up-to-date protocol.
    – Adrian Larson
    Commented Jun 27, 2016 at 20:18
  • 3
    @AdrianLarson - The communication is negotiated. SF Says to remote - We do not do 1.0, we can do 1.1, remote service says, we do not do 1.1 we do 1.0, sf says sorry. Basically if the remote service supports 1.1 it will negotiate to it. If they use multiple, it will negotiate to a common protocol. Basically if the service only uses 1.0 then SF will not connect to it
    – Eric
    Commented Jun 27, 2016 at 20:20
  • Ah, I interpreted OP as saying SF was using 1.0 and instead 1.1 or 1.2 would be preferred. I get it now.
    – Adrian Larson
    Commented Jun 27, 2016 at 20:21
  • Indeed. Qualys rates them 'F' -- they don't support 1.1 or 1.2. Boo -- I've contacted them. Commented Jun 27, 2016 at 20:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .