kalley / laravel-bigcommerce

Laravel package for Big Commerce PHP API (https://github.com/bigcommerce/bigcommerce-api-php)
MIT License
4 stars 5 forks source link

Broken #2

Closed InternetMedicineMan closed 9 years ago

InternetMedicineMan commented 9 years ago

I've been using this package for quite awhile now, but in the last 2 days it stopped working for me. The resultant error comes back:

error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

And when I send this off to BigCommerce their answer is:

From BigCommerce... Thank you for contacting Bigcommerce API support and allowing us time to look over your concern. The problem you are seeing is due to the recent deprecation of the RC4 cipher suite (please go to developer.bigcommerce.com to see the banner we posted regarding this). This is a PCI requirement change that needed to be done and we are now doing it globally to all Bigcommerce IP addresses. It is likely that your client libraries is making a specific call to use cipher. You will either need to modify the library/ scripts to not make these references or update to the latest client libraries available at https://developer.bigcommerce.com/api/clients . Please let us know if there is anything else we can do to help related to this case. As always, please don't hesitate to contact us if there any other API questions or issues you may have.

kalley commented 9 years ago

@geofflancaster you mind seeing if removing https://github.com/kalley/laravel-bigcommerce/blob/master/src/Kalley/LaravelBigcommerce/LaravelBigcommerceServiceProvider.php#L38 fixes this issue? I don't have a bigcommerce account, so I can't physically check this anymore, but it seems that would be the issue.

geofflancaster commented 9 years ago

Yes, that's the issue. BC changed the ssl ciphers that they allow. @internetmedicineman want to update and submit a PR?

InternetMedicineMan commented 9 years ago

I commented line 38 from the mentioned file which is: Bigcommerce::setCipher('RC4-SHA');

I guess that defines RC4 explicitly. Without it finds the closest matching cipher.

It works for me now.