+ Start a Discussion

Ending Support for Weak Versions of SSL

As part of salesforce.com's on going effort to ensure the highest level of security at Salesforce.com, we are discontinuing support for the Secure Socket Layer (SSL) protocols noted below on March 31, 2007. SSL is the protocol used to secure data in transit to and from Salesforce.com.

  • SSLv2 - SSLv2 has known vulnerabilities which render it insecure for all purposes. It was superceded 10 years ago by SSLv3. Implementations of SSLv3 are widely and freely available for all common development platforms.
  • SSLv3 and TLSv1 with key lengths less than 128 bits - For secure ciphers, the length of the key used by the cipher is proportional to the strength of the cipher. Due to advances in cryptography and computing power, key lengths lower than 128-bits are no longer considered sufficient for long term security.

This change may affect users accessing the system both via browsers and via an API client. We have analyzed our logs; we believe only a very small percentage of users will be affected. We have contacted all customers with integrations we believe may be impacted by this change.

For more information, please see our technical note on this change.  If you have any questions or need assistance planning your response to this change, please contact Salesforce.com Support.

Support for weak SSL ended on 3/31.  Since that time, some Tibco users have experienced difficulties connecting to Salesforce.com.   For information on the issue and for work around, please see our tech note on this topic.

Message Edited by dapkus on 04-05-2007 12:14 PM