Thank you for visiting our Partner Zone. This area is an exclusive space for MYOB Partners. Find out how to Partner with MYOB.
TLS - is the transport layer security, its the protocol used for transporting secure information over the internet.
When your code makes a secure call to an HTTPS endpoint, this needs to use the TLS protocol to ensure data is secured the best it can be. This used to be via SSL or other methods.
The MYOB SDK relies on the development frameworks, modules and components you have used to build your solution. You'll need to check that the libraries and components you used to build your software are using TLS1.1 or TLS1.2 protocol when they communicate over the internet.
Here's a blog post for a developer who faced a similar situation where an API dropped support for everything except TLS1.2 and how they modified their code (.net 4.0) to support that. https://blogs.perficient.com/2016/04/28/tsl-1-2-and-net-support/ there might be some tips in there that help you
I am feeling a bit dumb about TLS. I dont understand yet what exactly what I need to check for.
Could it be that I need to change the redirect url in the application registration on the my.myob developer dashboard ? Currently it is http://desktop
Still I see in the documentation at http://developer.myob.com/api/accountright/api-overview/getting-started/ that http is still being used.
I posted a question at https://stackoverflow.com/questions/52266661/how-do-i-know-what-to-change-in-my-code-regarding-tls
September 2018 - last edited September 2018
Can you advise whether I am right in thinking that because I am using the most up to date SDK in my winforms application ( February 2016) and the calls are happening on my client's PC, not via an intermediary web site, then there is nothing I need to do?
I do notice there is a recent commit in the SDK Github project.
I can’t see anything about TLS in it
Can you advise whether it will need changing and if so how?
If your code uses TSL1.0 then yes it will need to be updated.
You will need to check what tools you are including for making the API calls and check that is TLS1.1 or 1.2
Our add on runs on Windows and uses the .Net SDK Will it need to be upgraded?
As you will no doubt be aware, security on the internet is an ever evolving activity, and as such TLS1.0 is actively being retired from many services. This is due to known vulnerabilities that directly impact the integrity and security of communications, and these vulnerabilities are unable to be fixed in this older version of TLS.
MYOB is dedicated to ensuring the security of our client’s data and in 2017 our API infrastructure was upgraded to support TLS1.1 and TLS1.2 while allowing TLS1.0 connections as a fallback. Now is the time for us to remove this fallback, so as of 30th September 2018 the MYOB API will no longer accept connections using TLS1.0.
What will happen?
If you are using TLS1.0 and you choose to do nothing, your TLS1.0 calls to our API will be blocked and will fail. These calls will be considered insecure and will be blocked at the gateway.
What do I need to do?
You need to upgrade your infrastructure to ensure your API calls are using TLS1.1, TLS1.2 or greater, you will no longer be able to use on SSL3 or TLS1.0. Your teams will need to look at the impact of this and the change required for your calls to the MYOB API.
Once you update your servers to support TLS1.1 or greater, there is nothing else to change.
Want to know a little more? Check out this post from GlobalSign as it explains more about TLS, SSL and these changes.