CFHTTP: find out supported version of SSL & test auth.net with SSL 3.0

Question

Hello, recently received email from Authorize.net saying:

During the week of March 16 - 20, 2009, Authorize.Net will be deprecating all legacy support for the SSL 2.0 protocol. Changes have recently been made to the Payment Card Industry Data Security Standard (PCI DSS) which have made the use of SSL 2.0 a PCI DSS violation.

So question is: how to make sure that my ColdFusion apps, using cfhttp to communicate with auth.net service, wont become broken in March?

Trying to find out which versions of SSL supported but can not find such info.

Any suggestions?

EDIT

Found discussions: one & two. Seems that only reliable way is upgrading to CF8.

So, other quesiton now: how to test my code with new auth.net protocol? Any ways to switch dev env before going live?

Also I've sent email to dev support of auth.net with these questions. If they'll provide me with solution -- will post it here.

Answer 1

Here is a nice article on www.talkingtree.com regarding the matter:

ColdFusion Protocol Tags CFHTTP, CFINVOKE, CFLDAP support SSLv2

It looks like CF8 is the first version to support SSLv3.

You can also get your hands really dirty and make SSLv3 requests directly, using Java. This would of course require changing working code to emulate functionality that would come naturally with CF8. But if upgrading is not an option for you, maybe this is a viable alternative.

I can't say much about how to test your code against Authorize.net, I'm afraid.

Answer 2

Okay, finally The Gods Have Spoken -- Auth.net Developer replied:

We would recommend that each user verify their server SSL encryption protocol settings. If you are unsure where to find them a Google search of the server type along with SSL 3.0 should provide helpful information in this regard. Additionally, the server support resources should provide this information.

This change has been released to the test environment. You may use the following shared test account for testing purposes if you wish:

Login ID: xxxxxxxx

Password: xxxxxxxxx

Login URL: https://test.authorize.net

API Login ID: xxxxxxxx

Transaction Key: xxxxxxxxx

Post to URL: https://test.authorize.net/gateway/transact.dll

Note: this is new test account, but I think that all test accounts are changed now, will try to test.

At least, now I am able to test my transactions in sandbox before changes do live, that's what I've wanted.