Many of the eCommerce and online payment systems (such as PayPal and eWay) are now enforcing TLS 1.2 for their encryption. You may receive a notice from your payment provider stating that TLS 1.0 is no longer supported.
The emails may be entitled such things as:
- "Are you TLS 1.2 Ready?" (eWay)
- "Merchant Action Required: Upcoming TLS Structure Changes" (eWay)
- "Security-Related Changes Required To Avoid Service Disruption" (PayPal)
This doesn't relate to an SSL certificate for your site, but is related to the connection from your server to the payment gateway providers and other similar financial systems.
To ensure your system is using the latest TLS 1.2 protocol, there are a number of steps you can take (depending on your particular system). In all instances, the code making the request needs to enforce TLS.
Here's what you can do to check:
- Contact your developer if you currently have someone maintaining or devleoping your website. They should be aware of the changes and have probably already implemented them for you.
- Upgrade any payment plugins you have. If you're running WordPress / WooCommerce, this can be done through the WordPress Admin system.
- Check any PHP code to ensure the calls via cURL enforce TLS 1.2. This should look like:
curl_setopt($curl, CURLOPT_SSLVERSION, 6);
If you use any other library for remote calls, you will need to check any specific code to ensure it also enforces TLS 1.2.