SSL changes for api.orcid.org, pub.orcid.org, orcid.org

[Pedro Costa]

In recent months we made several SSL changes that affected ORCID APIs in order to meet best practices for SSL certification. We realize that these changes have caused issues for some integrations, and we sincerely apologize for neglecting to announce this change in advance.

• In June we updated the certificate provider for orcid.org, pub.orcid.org, api.orcid.org from GoDaddy to Sectigo Limited.
• On 15 Oct 2020 we started routing pub.orcid.org through Cloudflare, which caused the SSL cipher suites in use to change and the public IP.
• On 21 Oct 2020 we started routing api.orcid.org through Cloudflare, which caused the SSL cipher suites in use to change and the public IP.
• On 26 Oct 2020, we briefly changed the minimum allowed TLS version to 1.1. We reverted this change on 27 Oct 2020 after reports of issues from API users.

If you are experiencing SSL-related errors with your ORCID integration, you may need to:

• Check that your system is talking to the correct Cloudflare IP address:-

dig api.orcid.org

….

orcid.org.    299    IN    A    104.20.228.70

api.orcid.org.    299    IN    A    104.20.229.70

….

• Check that your service is making SSL connections using a high TLS version (preferably 1.2 and above.) You can setup a nginx server for instance and point your service at that and observe the connection type: https://serverfault.com/questions/620123/how-can-i-let-nginx-log-the-used-ssl-tls-protocol-and-ciphersuite

• Check that your service is able to negotiate a modern cipher suite as supported by Cloudflare https://developers.cloudflare.com/ssl/ssl-tls/cipher-suites

• Check that your system/application has an updated certificate authority repository for Sectigo

Our team is here to help in navigating any issues related to this change that you may encounter. Please contact us here on the user group or privately at sup...@orcid.org.

Again we’re sorry for this inconvenience, and we’re revising our internal processes to make sure that infrastructure changes affecting external-facing services are communicated well in advance.