MYOBCommunity
Partner Zone
|
|
Partner Zone

Ending TLS1.0 support for MYOB API

API Evangelist KeranM
297 Posts
API Evangelist
Australia
KeranM
API Evangelist

297Posts

91Kudos

56Solutions

Re: Ending TLS1.0 support for MYOB API

Hi there

 

TLS - is the transport layer security, its the protocol used for transporting secure information over the internet.

 

When your code makes a secure call to an HTTPS endpoint, this needs to use the TLS protocol to ensure data is secured the best it can be. This used to be via SSL or other methods.

 

The MYOB SDK relies on the development frameworks, modules and components you have used to build your solution. You'll need to check that the libraries and components you used to build your software are using TLS1.1 or TLS1.2 protocol when they communicate over the internet. 

 

Here's a blog post for a developer who faced a similar situation where an API dropped support for everything except TLS1.2 and how they modified their code (.net 4.0) to support that. https://blogs.perficient.com/2016/04/28/tsl-1-2-and-net-support/ there might be some tips in there that help you

 

Cheers

K.

Keran McKenzie
Futurist in residence @MYOB

Are you a developer? Check out http://developer.myob.com
Looking for an Add-on? Check out http://myob.com/addons/

Twitter: @myobapi | @keranm
Experienced Partner kirsten
94 Posts
Experienced Partner
Australia
kirsten
Experienced Partner

94Posts

2Kudos

3Solutions

Re: Ending TLS1.0 support for MYOB API

Hi Keran

I am feeling a bit dumb about TLS. I dont understand yet what exactly what I need to check for.

Could it be that I need to change the redirect url in the application registration on the my.myob developer dashboard ? Currently it is http://desktop

Still I see in the documentation at http://developer.myob.com/api/accountright/api-overview/getting-started/ that http is still being used.

I posted a question at https://stackoverflow.com/questions/52266661/how-do-i-know-what-to-change-in-my-code-regarding-tls
Thanks

Kirsten

Experienced Partner kirsten
94 Posts
Experienced Partner
Australia
kirsten
Experienced Partner

94Posts

2Kudos

3Solutions

Re: Ending TLS1.0 support for MYOB API

Hi Keran

Can you advise whether I am right in thinking that because I am using the most up to date SDK in my winforms application ( February 2016)  and the calls are happening on my client's PC, not via an intermediary web site, then there is nothing I need to do?

I do notice there is a recent commit in the SDK Github project.

Thanks
Kirsten

Experienced Partner kirsten
94 Posts
Experienced Partner
Australia
kirsten
Experienced Partner

94Posts

2Kudos

3Solutions

Re: Ending TLS1.0 support for MYOB API

 

I am using https://github.com/MYOB-Technology/accountright_sample_csharp/blob/master/MYOBApi.CSharp/Helpers/OAu...

 

I can’t see anything about TLS in it  
Can you advise whether it will need changing and if so how?

API Evangelist KeranM
297 Posts
API Evangelist
Australia
KeranM
API Evangelist

297Posts

91Kudos

56Solutions

Re: Ending TLS1.0 support for MYOB API

If your code uses TSL1.0 then yes it will need to be updated.
You will need to check what tools you are including for making the API calls and check that is TLS1.1 or 1.2

Keran McKenzie
Futurist in residence @MYOB

Are you a developer? Check out http://developer.myob.com
Looking for an Add-on? Check out http://myob.com/addons/

Twitter: @myobapi | @keranm
Experienced Partner kirsten
94 Posts
Experienced Partner
Australia
kirsten
Experienced Partner

94Posts

2Kudos

3Solutions

Re: Ending TLS1.0 support for MYOB API

Our add on runs on Windows and uses the .Net SDK Will it need to be upgraded? 

API Evangelist KeranM
297 Posts
API Evangelist
Australia
KeranM
API Evangelist

297Posts

91Kudos

56Solutions

Ending TLS1.0 support for MYOB API

As you will no doubt be aware, security on the internet is an ever evolving activity, and as such TLS1.0 is actively being retired from many services. This is due to known vulnerabilities that directly impact the integrity and security of communications, and these vulnerabilities are unable to be fixed in this older version of TLS.

MYOB is dedicated to ensuring the security of our client’s data and in 2017 our API infrastructure was upgraded to support TLS1.1 and TLS1.2 while allowing TLS1.0 connections as a fallback. Now is the time for us to remove this fallback, so as of 30th September 2018 the MYOB API will no longer accept connections using TLS1.0.

What will happen?
If you are using TLS1.0 and you choose to do nothing, your TLS1.0 calls to our API will be blocked and will fail. These calls will be considered insecure and will be blocked at the gateway.

What do I need to do?
You need to upgrade your infrastructure to ensure your API calls are using TLS1.1, TLS1.2 or greater, you will no longer be able to use on SSL3 or TLS1.0. Your teams will need to look at the impact of this and the change required for your calls to the MYOB API. 

 

Once you update your servers to support TLS1.1 or greater, there is nothing else to change. 

 

Want to know a little more? Check out this post from GlobalSign as it explains more about TLS, SSL and these changes.

Keran McKenzie
Futurist in residence @MYOB

Are you a developer? Check out http://developer.myob.com
Looking for an Add-on? Check out http://myob.com/addons/

Twitter: @myobapi | @keranm
Didn't find your answer here?
Try using advanced search to find a post more easily Advanced Search
or
Get the conversation started and make a new post Start a Post