Project

Profile

Help

Disabling weak cryptographic standards: TLSv1.0 and TLSv1.1

Security Improvement
Added by Holger Just over 1 year ago

When connecting to Planio, we always use secure and encrypted communication channels, namely TLS (also colloquially known as SSL) and SSH. The use of cryptographic algorithms in these protocols have changed over time, resulting in newer and more secure standards being used and taking the place of older standards. In the last couple of years, there have been a number of published attacks on some of these older standards such as POODLE, Logjam, or DROWN. While there have been workarounds for some of these attacks, some can not be fully mitigated without retiring the use of the affected cryptographic standards.

As a result, starting June 18, 2018, Planio will discontinue the support of the older cryptographic standards TLSv1.0 and TLSv1.1.

This applies to all HTTPS connections to your Planio account, to Subversion and Git repositories accessed via HTTPS and connections to our Team Chat servers if you are using an external IRC client.

The vast majority of connections to our servers already use the more modern standards and are thus not affected by this change at all. If you are using a reasonably modern webbrowser which was updated in the last couple of years, it likely already supports and uses the more secure and modern cryptographic standards. Reasonably current versions of Git and Subversion clients should also have no problems accessing our servers after June 18.

If you are using older versions of Java to access our Servers, e.g. with the use of plugins to your IDE or with CI servers, you might have to ensure that your version of Java is up-to-date. When using Java JDK 8 or newer (released in 2014), everything should work as before. Older versions of Java however disabled TLS 1.2 by default for compatibility reasons. Older versions of OpenSSL (which might still be used by old operating systems like RedHat 5) might not be able to access our services after June 18 anymore and might need to be updated.

Should you face any issues accessing our services after June 18, please make sure you have updated your clients to their latest version. For any questions related to this change, please don’t hesitate to get in touch with us via https://plan.io/contact/.


Comments

Please register to add a comment