Got the following from Worldpay about SSL and TLS 1.0. Anyone know what needs to be done? Several locations currently running Aloha EDC 14.1.20 on Windows 7
April 24, 2018
SSL 3 and TLS 1.0 decommissioning in 2018
Take steps to prepare before April 30
Payment Card Industry (PCI) rules will soon require Worldpay to use stronger cryptography – Transport Layer Security 1.2 (TLS 1.2) – wherever payment card information is sent or received.
Transport Layer Security is a secure protocol replacing Secure Sockets Layer (SSL), which remains in widespread use today. Since its development in 1999, TLS 1.0 has since been superseded by TLS 1.1 and TLS 1.2.
Please note: Security experts no longer consider SSL 3 and TLS 1.0 to be strong cryptography. The continued use of either can no longer be used to send secure payment information to any transaction processor, including Worldpay, after June 30, 2018.
Important dates for your calendar
• Between now and April 30, Worldpay customers using terminals that are no longer compliant will be sent a replacement at no charge.
• Please install this terminal when it arrives. A member of our Customer Care team will call you to assist with installation shortly after we ship your terminal.
• In some cases, existing customer terminals simply require software downloads. A member of our Customer Care team will call you to assist with this as well.
• We will disable all SSL versions and TLS 1.0 in our production environments on April 30, 2018.
How this affects our customers
To continue processing payments, customers must disable SSL 3 and TLS 1.0 entirely and switch to a more modern encryption protocol.
We strongly recommend using TLS 1.2, as not all implementations of TLS 1.1 are considered secure.
The changes customers will need to make will vary, but here some common steps:
Investigate and Act
• Install your new terminal if you receive one from Worldpay.
• Have your information technology and website support teams run system vulnerability scans.
• Contact your suppliers (such as your payment terminal or point-of-sale system provider) to examine any managed firewalls to ensure they all use modern encryption protocols.
• Reconfigure any existing software to accept TLS 1.1 protocols.
• Use web browsers that minimally use TLS 1.1.
Review and Maintain
• Test and begin using any new terminal you receive on or before April 30.
• Continue to update your encryption protocols to the latest versions going forward.
Find out more
Thanks for your time and attention to this important matter. You are welcome to contact the Worldpay Technical Help Desk at 800.859.5965, Option 2, if you have additional questions.
As always, Worldpay appreciates your business and we thank you for being a loyal customer.
This content is not intended to provide a complete explanation of applicable laws, rules, or regulations. It should not be considered legal or compliance advice. Individual situations will differ, and any questions or concerns should be discussed with your own lawyers and advisors.
©Worldpay 2018. All rights reserved. Worldpay, the logo and any associated brand names are trademarks of the Worldpay group of companies. All other trademarks are the property of their respective owners. Worldpay US, Inc., is a registered ISO/MSP of Citizens Bank, N.A., Wells Fargo Bank, N.A., and Eagle Bank, N.A.
Worldpay | 201 17th Street NW | Suite 1000 | Atlanta, GA 30363
