pycurl and SSLv3

[john]

Hi,

On the server side of my Django website I use pycurl (version 7.20.x) to
connect to authorize.net (to send credit card info). On Nov 4
Authorize.net will turn off SSLv3. So I'm wondering if my use pycurl
will continue to work. To be honest I haven't thought about it much
since the pycurl seem to take care of everything that Authorize.net
required. Now I'm questioning if pycurl will continue to work and if I
need to change anything - what do I chan.

c=pycurl.Curl()
c.setopt(c.URL, GatewayURL)
c.setopt(c.POST, TRUE)
c.setopt(c.SSL_VERIFYPEER, FALSE)


Thanks in advance,
Johnf

[Erik Cederstrand]

This would depend on the version of libcurl on your server, and ultimately on the version of libssl.

I assume authorize.net will only accept TLS, so just force the SSL version and test if it works. Something like this should do:

c.setopt(c.SSLVERSION, c.CURL_SSLVERSION_TLSv1_2)


Erik

[Tom Evans]

Why do you disable peer verification checks? Its like asking for a
MITM to come and scoop up those credit card details.

pycurl uses curl, curl can be built against OpenSSL. If your curl
library is linked against an OpenSSL library that disables all TLS and
only supports up to SSLv3, then you will have problems. That would be
quite unlikely.

Cheers

Tom