Deprecation of encryption algorithms below 256 bits
JulienDefrance opened this issue · comments
As per Aftership's Feb 4th, email:
The purpose of this email is to update you regarding the deprecation of encryption algorithms (below 256 bits). It will be done for all our API services from 25th Feburary 2021.
If you’d like to test endpoints, then please use api-tls.aftership.com for testing. It supports all the endpoints!
Overriding the API endpoint, this indeed will be an issue with the Aftership SDK in its current form.
While requests succeed when launching a rails console with:
AFTERSHIP_API_ENDPOINT=https://api.aftership.com rails c
Requests are failing when changing it as per the email suggestion:
AFTERSHIP_API_ENDPOINT=https://api-tls.aftership.com rails c
[4] pry(main)> AfterShip::V4::Courier.get_all { :meta => { :code => 500, :message => "Something went wrong on AfterShip's end.", :type => "InternalError" }, :data => { :body => "<!DOCTYPE html>\n<html lang=en>\n <meta charset=utf-8>\n <meta name=viewport content=\"initial-scale=1, minimum-scale=1, width=device-width\">\n <title>Error 400 (Bad Request)!!1</title>\n <style>\n *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}\n </style>\n <a href=//www.google.com/><span id=logo aria-label=Google></span></a>\n <p><b>400.</b> <ins>That’s an error.</ins>\n <p>Your client has issued a malformed or illegal request. <ins>That’s all we know.</ins>\n", :cf_ray => nil } }
Thanks for the reporting, we acknowledged the issue and handing this bug at the moment, will update here again soon, thank you very much
Thank you. As you work on this issue, and possibly release a new version of your ruby gem, would you mind reviewing some of the open PRs, such as #32 which will ensure people depending on more recent versions of HTTP Client can upgrade to your most recent gem, without having to fork it? Thanks in advance.
this will be handled by #33 as we found that all the new version of httpclient are unable to fix the issue, as httpclient has stopped development as well
the PR has been merged and released as 4.4 (ruby 2.4 up)
https://rubygems.org/gems/aftership/versions/4.4.0
Can you verify on your side?
Yes, I'll be updating you shortly.
Upgraded to 4.5.1, relaxed some of the faraday constraints on our other gems, and re-ran all a couple of calls against current and upcoming TLS endpoints. All is looking good. Thanks again for prioritizing this so quickly.
Thank you very much for the reporting.