Stunnel Guide for CN!Express 3 April 2017

Transcription

1 Stunnel Guide for CN!Express 3 April 2017 When communicating with the CN!Express payment application from a remote server, the communications between the two servers must be secured. Auric requires CN!Express be operated behind a secure proxy such as stunnel, Microsoft IIS, nginx, or Apache web server. The stunnel proxy service provides a secure wrapper for both inbound and outbound CN!Express HTTPS traffic. The stunnel proxy provides full support for TLSv1.2 and can be upgraded independently of the CN!Express application. This allows you to regularly upgrade your inbound security without impacting the underlying CN!Express application. From the stunnel.org web site, Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code. Its architecture is optimized for security, portability, and scalability (including load-balancing), making it suitable for large deployments. Auric deploys stunnel in several production environments. It is available for many operating systems including Windows, Linux, and OS X. This guide focuses on a Windows deployment. The stunnel proxy can also be used to convert outgoing HTTPS communications to TLSv1.2. The PCI council has set a deadline of June 2018 for mandatory TLSv1.2 support. However, several payment processors are already migrating their services more than a year and a half ahead of that deadline. A single stunnel installation can support both CN!Express and Trevance configurations. Please refer to the Trevance stunnel configuration guide for details. A wide array of stunnel information is available on the Internet. Auric Systems International is a Validated Level 1 PCI Service Provider

2 Data Flow Server Transaction Source Real-time transactions to CN!Express Stunnel Config File Sections cnx_https CN!Express Payment Application xyz out Payment Processor The above diagram is a high-level overview of a transaction data flow once stunnel is installed and configured. Transactions are sent via HTTPS (TLSv1.2) to the default CN!Express port. Stunnel is configured to accept HTTPS transactions. This configuration is in the cnx_https section of the included stunnel.conf file. Stunnel forwards the transaction via HTTP to the local CN!Express application. CN!Express transforms the request and sends it back to stunnel via HTTP. Stunnel has configuration sections (xyz_out) for each payment processor and for test/production connections. Stunnel forwards the transaction via HTTPS (TLSv1.2) to the payment processor. Auric Systems International is a Validated PCI Level 1 Service Provider Page 2 of 10

3 Install Stunnel for Windows Download the latest stunnel for Windows from: Confirm the SHA256 signature matches the signature from the download site. The download you choose will have a corresponding signature download file ending in sha256. Run the installer. When prompted to Choose Components, choose the default (Tools and shortcuts). Recommend you accept the default installation location: C:\Program Files (x86)\stunnel. The installer prompts you to create client-side certificates (.pem files). Answer the following questions: Country Name (2 letter code): State or Province Name: Locality Name (city): Organizational Name (company): Organizational Unit Name (typically left blank): Common Name: Hostname of the server running stunnel. Edit the provided stunnel.conf file if necessary (see below). Copy your edited stunnel.conf file to: C:\ Program Files (x86)\stunnel\config\stunnel.conf Restart stunnel. NOTE: The installed stunnel SSL certificate has a one-year lifetime. It will expire in a year. Auric provides a batch file to generate a certificate that is good for ten (10) years. Download the CreateNewStunnelCert.bat batch file from the Auric stunnel download area. Move the batch file into the stunnel installation directory: C:\Program Files (x86)\stunnel\ Right click CreateNewStunnelCert.bat and select Run as Administrator. Answer the following questions: Country Name (2 letter code): State or Province Name: Locality Name (city): Organizational Name (company): Organizational Unit Name (typically left blank): Common Name: Hostname of the server running stunnel. The new ten (10) year certificate is generated and installed. Auric Systems International is a Validated PCI Level 1 Service Provider Page 3 of 10

4 Running stunnel as an Application After the initial installation, it is useful to run stunnel as an application (vs. a service). Start stunnel from: Start>All Programs>stunnel>stunnel GUI start Running stunnel as a service allows you to quickly restart it and to also view the generated log files while working on the initial CN!Express configuration. Running stunnel as a Service Install the stunnel service from the Start menu. Then use normal services controls. Start>All Programs>stunnel Service Install Configure the CN!Express Application Use the CN!Express configuration utility to set the Web Service as follows: HTTP Server Port: 9100 Server IP: These settings allow CN!Express to listen to the default stunnel configuration. Auric Systems International is a Validated PCI Level 1 Service Provider Page 4 of 10

5 The stunnel.conf Configuration File The configuration file can be edited with a standard text editor (e.g., Notepad or Notepad++). Do not use a word processor such as WordPad or Word. General Settings The logging levels are controlled by the debug line. Values can be from 0 through 7. 0 logs only catastrophic messages and 7 logs a lot of debug information. The default setting is 5. You may want to set this to 6 (or even 7) while working on initial configurations. Example: Debug = 5 cnx_https The cnx_https section controls where stunnel listens for incoming HTTPS requests and determines the port on which the transactions are forwarded to CN!Express. The defaults are as follows: [cnx_https] accept = 8100 connect = :9100 TIMEOUTclose = 71 The default settings expect incoming HTTPS transactions on port 8100 and will forward the requests via HTTP to a CN!Express listening on port The TIMEOUTclose setting determines the number of seconds to wait for a response. Processor Specific Settings The stunnel.conf file contains sections for each payment processor s test and production URLs. By default all the sections are enabled. You can leave them enabled or comment out the sections you do not use. Each processor-specific stunnel.conf section follows the same pattern: [NAME_test/prod_out] ; Comment containing the payment processor name. client = yes sslversion = TLSv1.2 ; port on which CN!Express communicates with stunnel. accept = 9211 ; The payment processors domain and port (usually 443) connect = processor_domain:443 ; Number of seconds to wait for a response. TIMEOUTclose = 70 Please refer to the following processor-specific sections for details. Auric Systems International is a Validated PCI Level 1 Service Provider Page 5 of 10

6 Chase Paymentech Orbital Gateway CN!Express Configuration Configure the CN!Express URL settings as follows: URL: Secondary URL: Test URL: Secondary Test URL: Notes Chase Paymentech/Orbital gateway has two production and two test URLS. This requires two stunnel entries that listen on different ports. Auric Systems International is a Validated PCI Level 1 Service Provider Page 6 of 10

7 Merchant e-solutions/trident/cielo CN!Express Configuration Configure the CN!Express URL settings as follows: URL: Test URL Auric Systems International is a Validated PCI Level 1 Service Provider Page 7 of 10

8 PayPal Payflow Pro CN!Express Configuration Configure the CN!Express URL settings as follows: URL: Test URL: Notes In order to configure the PayPal Payflow Pro URLs you must first upgrade to the CN!Express configuration utility available for download with stunnel. The configuration utility bundled with CN!Express does not allow you to modify the processor URLs. Due to PCI restrictions, Auric is providing an upgraded Configuration Utility as a separate download. The upgrade is only required for Payflow Pro configurations. Please contact support@auricsystems.com regarding the availability of this update. Auric Systems International is a Validated PCI Level 1 Service Provider Page 8 of 10

9 TransFirst/Tsys CN!Express Configuration Configure the CN!Express URL settings as follows: URL: Test URL: Auric Systems International is a Validated PCI Level 1 Service Provider Page 9 of 10

10 Litle/Vantiv CN!Express Configuration Configure the CN!Express URL settings as follows: URL: Test URL: ### Auric Systems International is a Validated PCI Level 1 Service Provider Page 10 of 10