function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
Ben PelcygerBen Pelcyger 

Will the WWW::SalesForce Perl module be impacted by SFDC disabling SSL 3.0 connections?

I use the Perl module WWW::SalesForce::Simple.  Will the functionality of that module be impacted by the disabling of SSL 3.0 encrypted connections?  If so, is there an available update?
PratikPratik (Salesforce Developers) 
Hi Ben,

Please refer to this Knowledge article:
https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-disabling-SSL-3-0-encryption&language=en_US

Thanks,
Pratik
Ben PelcygerBen Pelcyger
Hi Pratik:

From your link, I see that IF the module does not use the correct encryption I will need to update my integration.  However, this does not tell me which encryption the module uses.  I was hoping this was a proliferate module that someone would know.  Is the status of this module something that is known?

Thanks,
Ben
Victor ParadaVictor Parada
I'd like to know the same thing. I tried analyzing the WWW::Salesforce (http://search.cpan.org/~phred/WWW-Salesforce-0.22/lib/WWW/Salesforce.pm) module's dependencies, and found Crypt::SSLeay (http://search.cpan.org/~nanis/Crypt-SSLeay/SSLeay.pm), IO::Socket::SSL (http://search.cpan.org/~sullr/IO-Socket-SSL-2.002/lib/IO/Socket/SSL.pod), Net::SLLeay (http://search.cpan.org/~sampo/Net_SSLeay.pm-1.25/SSLeay.pm) and LWP::Protocol::https (http://search.cpan.org/~mschilli/LWP-Protocol-https-6.06/lib/LWP/Protocol/https.pm) modules. It seems that there is a relationship between all of these modules, and documentation mentions TLS lightly, so I guess we have to test our perl tools against a SSL3.0-less Salesforce site. Are sandboxes still SSL 3.0 enabled?
Victor ParadaVictor Parada
Answering myself, from Pratik's posted link:
 
Instances SSL 3.0 Disable Schedule
All Sandbox Instances Friday, November 7, 2014

That means that sandbox instances have been updated last week.

I've tested one of my perl scripts against our sandbox instance, successfully. BTW, our sandbox address is <https://cs9.salesforce.com/> through login address <https://test.salesforce.com/services/Soap/c/10.0>.

So, it seems that WWW::Salesforce::Simple perl module is not affected by this change.

I hope this helps...
 
Ben PelcygerBen Pelcyger
My hero! :)  I'll test then mark as closed.
Scott HungScott Hung
I faced the same dilemma for the Databasedotcom Ruby gem and put together a post that uses tcpdump & wireshark that shows you what security protocol is used.
Ben PelcygerBen Pelcyger
Do you have a link to that post Scott?

-Ben
Scott HungScott Hung
Lol!  Posting the link would be useful, eh?  Here it is:  https://scotthung.wordpress.com/2014/11/10/how-to-check-the-https-security-protocol-used/
Victor ParadaVictor Parada
I did the same analysis using Wireshark while running the test. My perl script appeared to be using TLS 1.2 against sandbox at test.salesforce.com. (Screenshot (http://www.parada.cl/kk/Salesforce-TLS.png))
Then, I repeated the capture while running against production at login.salesforce.com, obtaining the same version number, i.e. the script was already using the latest available TLS protocol!!!