6

I have developed an application in C# that makes use of the Salesforce API via a WSDL and need to ensure that the upcoming disabling of SSL3.0 will not affect functionality. I have never had to do any specification of the security protocol when using the webservice, so I am not sure what to do.

How do I:

  1. Determine what protocol is currently being used in my implementation.
  2. Set it to use TLS (if necessary)
12

The protocol used will depend on the .NET version you are using.

If running under .NET 3.5 it will support TLS1.0 by default and fall back to SSL3 if it fails. With .NET 4+ the default is also TLS1.0 falling back to SSL3 (at least when I checked the initial value in a .NET 4.5.1 application).

When Salesforce disables SSL3 the fall back option will be removed, but that shouldn't be an issue as TLS1.0 is the first option anyway.

With code you can explicitly remove the option to fall back to SSL3. The options for .NET 4 could be extended to include TLS 1.1 and 1.2 as well.

The settings are changed using the System.Net.ServicePointManager.SecurityProtocol class and the SecurityProtocolType enum. Multiple values can be combined using the bitwise or operations. E.g.

System.Net.ServicePointManager.SecurityProtocol = 
    SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;

Note that this setting applies to the entire AppDomain. So it can apply to more than just your immediate code.

If you have any hosted web services that Salesforce calls into you should also check the configuration of those to ensure they don't support inbound requests using SSL 3.0. There is a good scanning tool at https://www.ssllabs.com/ssltest/analyze.html Be careful with disabling SSL 3.0 on web services called by Salesforce. Currently they may still be making callouts with SSL 3.0 up until the 10th of December.

“Additionally, Salesforce recommends customers disable SSL 3.0 encryption in their own IT environment as soon as possible, unless they use call-out integrations. If a customer uses call-out integrations, and they have not already disabled SSL 3.0 in their own environment, then Salesforce recommends that they wait until after Salesforce has disabled SSL 3.0 for outbound requests.Source

For reference:

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.