Q2 TLS 1.0 Disablement Frequently Asked Questions 12/4/17
Executive Summary Q2 will be disabling the TLS 1.0 encryption protocol in favor of TLS 1.1 or higher on May 1, 2018. TLS is a security protocol and provides privacy and data integrity between two communicating applications. There are two potential major impacts to your organization that may require you to further communicate with your customers and third-party solutions providers. We will have resources available to help you do this if your organization will be impacted. Upgrading to TLS 1.1 or higher means data sent between applications is safer and more secure. The security of your data is our number one priority, and is the main driver behind this disablement. Frequently Asked Questions Q: What is TLS? A: TLS stands for Transport Layer Security. It is a protocol that provides privacy and data integrity between two communicating applications. It s the most widely deployed security protocol used today, and is used for web browsers and other applications that require data to be securely exchanged over a network. TLS ensures that a connection to a remote endpoint is the intended endpoint through encryption and endpoint identity verification. The versions of TLS, to date, are TLS 1.0, 1.1 and 1.2. Q: What is the change, when is it happening and how does this impact my organization and customers? A: Q2 is requiring an upgrade to TLS 1.1 or higher beginning on May 1, 2018. On that date, we will begin disabling the TLS 1.0 encryption protocol, which may prevent you or your customers from accessing some or all of their online banking services. There are two major impacts to your organization and your customers: Android: 1. Browsers and mobile operating systems will need to be upgraded. 2. Third-party solution providers potentially will need to upgrade to support TLS versions greater than 1.0. (i.e. TLS 1.1 or 1.2) Users operating on Android version KitKat (4.4) and lower, which includes about 20% of the U.S. population according to current usage patterns, may be impacted by the disablement of TLS 1.0 as these versions do not support TLS 1.1 and 1.2. Upgrading to Lollipop (5.0) or higher will fix this issue and support TLS 1.1 and 1.2. P 2 Page
Please visit the Android Developer portal for the most up-to-date statistics on Android versions and usage. The data on this page is updated every 7 days. Browsers: Please reference the chart below for browser versions that support TLS 1.1. and higher. If your customers are using a browser version that is lower than those listed below, they may not be able to access some or all of their online banking services. Microsoft Internet Explorer (IE): version 11 and higher Microsoft Edge all versions Mozilla Firefox: version 27 and higher Google Chrome version 38 and higher Apple Safari Desktop Safari: versions 7 and higher for OS X 10.9 (Mavericks) and higher (7) Mobile Safari: versions 5 and higher for ios 5 and higher Q: Why is Q2 doing this? A: TLS aims to provide privacy and data integrity between two communicating applications. TLS 1.1 and above provide significantly higher security controls than TLS 1.0. Protecting your customer s data is of the utmost importance for us, and this disablement will allow us to better ensure the security of your data. Our goal is to make this process as seamless as possible while maintaining the highest security standards. Q: How will the Q2 platform and third-party integrations be affected? A: Q2 is currently conducting an inventory of all third-party solutions providers to determine which interface changes need to be made. We need your help in working with these third-party solutions providers to ensure they are aware of the May 1, 2018 end of support date. We will have a template available soon for you to use to communicate with third-party solutions providers and your customers. Q: Am I ready to upgrade to TLS 1.1 or higher? A: Please reference our TLS Readiness Checklist, located in the Support Assistance library in the customer portal, to prepare for the upcoming disablement of TLS 1.0. Get started early and upgrade your environment to TLS 1.1 or higher so you can be prepared for the May 1, 2018 disablement date. You can use this website to check your version of TLS. Q: What happens if end users don t upgrade their browsers or mobile systems in time? A: On the May 1, 2018 cut-off date, all systems will be changed so TLS 1.0 traffic will be redirected to a page that will say Stronger Security is Required. The message might be in the browser window or it 3 Page
might appear in the tab of the browser as seen below. The Stronger Security is Required page was implemented to ensure a secure connection to your banking application was enforced. A screenshot of the message on a browser is below. The browser message will look the same no matter what browser the end user is on. We advise you to, should you get end user questions about this situation after May 1, ask your end users to look for these messages in their browser window and/or tab, as well as their mobile application. If they receive the Stronger Security is Required message in their browser, they will need to upgrade their browser version according to the chart in Question 2. Q: How can I avoid my customers/members being negatively impacted? A: It is crucial that you communicate to your customers early and frequently until May 1 st and beyond. Your customers will need to update their browsers and mobile operating systems and you will need to work with your third-parties to make them aware of the upcoming disablement. Please use both the third-party provider and customer communication templates located in the Support Assistance Library in the customer portal as a starting point to communicate. We also have a TLS Readiness Checklist available in that same library to help you through the process. Contact your Client Experience Manager with any additional questions or concerns. 4 Page
*This document will continue to be updated as we make more resources and information available. Please keep checking back for updates 5 Page
6 Page