Update: As of 9:10am (SYD Time) 2nd May 2018 TLSv1.0 and TLSv1.1 has now been turned off at a network level across all Qvalent applications. This means if you try and connect using TLSv1.0 and TLSv1.1 you will receive a network level connection error.
Warning |
---|
What is happening?Starting in December 2015, we will begin disabling the TLS v1.0 and v1.1 encryption protocols . This, please see below the schedule for disablement. This approach will prevent any TLSany TLS v1.0 and v1.1 connection to accessto access Qvalent/Westpac services as per our obligations for PCI compliance. |
Style |
---|
.acs-side-bar {background-color: #FFFFFF;} |
Info |
---|
Why is this happening? |
At Qvalent we treat the protection of our customers' data very seriously. Sometimes we need to make security improvements and retire older encryption protocols. This allows us to maintain the highest security standards and promote the safety of your data. To maintain alignment with these best practices |
and updated compliance requirements from the PCI Security Standards Council, Qvalent will disable the use of TLS |
v1.0 and |
v1.1 for connections to Qvalent/Westpac services. Note that as of the 23rd Dec 2015 the PCI has now granted an extension for existing customers to migrate from TLSv1.0 & TLSv1.1 to TLSv1.2 from 30th June 2016 to 30th June 2018, however all new customers must be on-boarded using TLSv1.2. PCI Council grants extension for existing TLS customers to 30th June 2018 |
On this page
Table of Contents | ||
---|---|---|
|
Related pages
- TLSv1.2 Browser Compatibility
- Internet Explorer Support for TLSv1.2
- Visit the Browser TLS Version Check page
How do I know if we are ready for this change?
After Quickstream disables TLS v1.0 and v1.1, any connection to Qvalent/Westpac services must use the TLS v1.2 encryption protocol.
This change also impacts access to web to Westpac web sites and products such as:
- Westpac Quickstream (including QuickWeb, QuickConnect, QuickVault, QuickView, QuickTerminal, QuickGateway etc.)
- Westpac PayWay (including PayWay Net, API, Virtual Terminal etc.)
- Westpac iLink and WIBS
- Westpac QuickSuper
- Westpac Payments Plus and Supplier Finance
- Westpac Invoice Finance
- Westpac Batch Advantage
There two are different channels that need encryption to access Qvalent/Westpac services. These channels are:
- Internet Browser
- API integrations
An overview of each are below:
Internet Browsers
When When using most browsers, you will not have trouble accessing Qvalent/Westpac services. But you may have trouble if:
- You You are not using a supported internet browser, or
- Your Your browser has disabled the supported encryption protocols
To quickly To quickly test your browser compatibility, you can visit our test page, which has TLS v1.0 and v1.1 disabled.
If you are able to view the site without errors, access to services via your browser should not be impacted by this change. If If you receive an error, the page displays Steps for Resolution. Following these steps will help you change the settings in your browser, or upgrade to a newer version.
Info |
---|
Find out more about TLSv1.2 Browser Compatibility. If you have Microsoft Internet Explorer, refer to the Internet Explorer Support for TLSv1.2 page for additional information. |
API Integrations
After Quickstream disables TLS v1.0 and v1.1, any connection to Qvalent/Westpac services must use the TLS v1.2 encryption protocols
API
Integrationsintegrations are interfaces
or applicationsto Qvalent and Westpac services that are separate from
Quickstream, but use
Quickstream data.Qvalent and Westpac data.
Examples of API integrations are:
- Secure token request for QuickWeb, QuickConnect, QuickVault, and PayWay Net.
- API requests for QuickGateway, QuickVault or PayWay API.
If you have implemented any
API Integrations, please ensure that the TLS 1.1 and/or TLS 1.2 encryption protocols are enabled in those integrations.of these features, make sure you have enabled the TLS v1.2 encryption protocol.
Info |
---|
API integrations that use Java will generally need to use Java 8 or higher to enable TLS |
v1. |
2 by default. You may also use Java 7 and enable TLS |
v1.2 using |
the https.protocols Java system property |
. You may also need to make code changes to enable TLS |
v1. |
2 |
. |
Services that run on Windows Server systems and use Microsoft Secure Channel for |
TLS must run on Windows Server 2008 R2 or higher. |
This generally includes most .NET applications and Microsoft Internet Information Server (IIS). Earlier versions of Windows Server do not |
support TLS |
v1. |
API Integrations that use OpenSSL will need to use OpenSSL 1.0.1 or newer. Earlier versions of OpenSSL do not support TLS 1.2 or TLS 1.1.
2. |
Refer to the Internet Explorer Support for TLSv1.2 page for additional information. API Integrations using NSS will need to use 3.14 or newer (preferably 3.15.1 or newer). Versions |
before 3.15.1 do not support TLS 1.2. |
To test the compatibility of an API
client that uses SOAP to communicate with Quickstream:
Set up an API client in a test environment.
In that test environment, change the API client's login endpoint hostname from login.Quickstream.com or [MyDomain].my.Quickstream.com to tls1test.Quickstream.com.
As an example, change https://login.Quickstream.com/services/Soap/u/32.0 to https://tls1test.Quickstream.com/services/Soap/u/32.0 while leaving the path as-is.
Log in with that API client.
If you see an error message that resembles the following: "INVALID_LOGIN: Invalid username, password, security token; or user locked out." or “Content is not allowed in prolog.”, then this test passed and your integration works with either TLS 1.1 or TLS 1.2.
The presence of this response means that the underlying TLS connection was successful, despite the higher-level error. The TLS connection is the focus of this test.
integration to communicates with a Qvalent/Westpac service:
PayWay
- Point your test environment to connect to the PayWay. You may have implemented
- PayWay Net with a secure token request, or
- PayWay API
- Perform a secure token request or API request using the TEST merchant.
- If you do not receive an error message that resembles the error message below, then the underlying TLS connection was successful and your integration works with TLS v1.2.
If you instead see an error message that
resembles the error message below, then the test has failed. Your
systems need adjustments or upgrades to
properly with
these services, when
To test the compatibility of an API client that uses REST to communicate with Quickstream:
Set up an API client in a test environment.
In that test environment, change the API client's access token retrieval endpoint hostname from login.Quickstream.com or [MyDomain].my.Quickstream.com to tls1test.Quickstream.com.
As an example, change https://na1.Quickstream.com/services/oauth2/token to https://tls1test.Quickstream.com/services/oauth2/token while leaving the path as-is.
Alternatively, it's possible to change an API client's service URL from [instance].Quickstream.com or [MyDomain].my.Quickstream.com to tls1test.Quickstream.com.
As an example, change https://na1.Quickstream.com/services/data/v32.0/ to https://tls1test.Quickstream.com/services/data/v32.0 while leaving the path as-is.
If you see an OAuth error, an "INVALID_SESSION_ID Authorization required" error, or a "400 Bad Request" error, then this test passed.
The presence of this response means that the underlying TLS connection was successful, despite the higher-level error. The TLS connection is the focus of this test.
we deactivate TLS v1.0 and v1.1.
Code Block language text HTTP 403 error, TLSv1 is not strong encryption, please use TLSv1.2 instead
Quickstream
- Re-instate your test environment to connect to the Qvalent/Westpac service test environment. You may have implemented
- a QuickWeb/QuickConnect/QuickVault with a secure token request, or
- a QuickGateway
- Perform a secure token request or API request to the test environment.
- If you do not receive an error message that resembles the error message below, then the underlying TLS connection was successful and your integration works with TLS v1.2.
If you instead see an error message that resembles the error message below, then the test has failed. Your systems need adjustments or upgrades to properly with these services, when we deactivate TLS v1.0 and v1.1.
Code Block language text HTTP 403 error, TLSv1 is not strong encryption, please use TLSv1.2 instead
iCIS HTTP File Transfers / Superannuation Messages
- Re-instate your test environment to connect to the Qvalent/Westpac service test environment. You may have implemented
- a HTTP file transfer or
- a QuickSuper gateway message
- Perform a HTTP post to the test environment.
- If you do not receive an error message that resembles the error message below, then the underlying TLS connection was successful and your integration works with TLS v1.2.
If you instead see an error message that
resembles the error message below, then the test has failed. Your
systems need adjustments or upgrades to
properly with
these services, when
we deactivate TLS v1.0 and v1.1.
Code Block language text HTTP 403 error, TLSv1 is not strong encryption, please use TLSv1.2 instead
What action do I need to take?
To maintain access to Qvalent and Westpac services make sure your browsers and integrations have TLS v1.2 enabled.
If your browser or integration does not have TLS v1.2 enabled after we make this change, then your users will NOT be able to access Quickstream.
We recommend that you begin planning to support TLS v1.2 as soon as possible. If you are in a corporate environment, contact your I.T. administrator.
We only have a small number of users, all of whom use regular browsers. What action do we need to take?
To maintain seamless access to Qvalent and Westpac services, make sure that browsers connecting to Quickstream have TLS v1.2 encryption or higher enabled.
Your end user can visit our test page, which has TLS v1.0 and v1.1 disabled to test their browser compatibility. Your end users do not need to update their browsers if they pass the test.
When will Qvalent/Westpac disable TLS v1.0 and v1.1 encryption?
We plan to disable TLS v1.0 and v1.1 encryption according to the following schedule:
Update: As of 9:10am (SYD Time) 2nd May 2018 TLSv1.0 and TLSv1.1 has now been turned off at a network level across all Qvalent applications. This means if you try and connect using TLSv1.0 and TLSv1.1 you will receive a network level connection error.
Where can I get more information?
Find out more about TLSv1.2 Browser Compatibility.
If you have Microsoft Internet Explorer, refer to the Internet Explorer Support for TLSv1.2 page for additional information.
If you have any additional questions, please reach out to Customer Support by opening a case via the Help & Training portal.contact our Quickstream Technical Support team.
To report a security concern or vulnerability email security@qvalent.com
Note |
---|
DisclaimerThese guidelines are general in nature and have been prepared without knowledge of the specific environment in which your systems operate. These guidelines are current at the time of writing, but may require update over time. They should not be forwarded to any other party without Westpac’s written consent. Except where contrary to law, Westpac intends by this notice, to exclude liability for these guidelines and the information contained in them. While Westpac has made every effort to ensure these guidelines are free from error, Westpac does not warrant their accuracy, adequacy or completeness. |