Hi Jay,

Did you happen to see this information in our last newsletter?


Please let us know which rating URL you've been using. They might be having some temporary service problems. Unfortunately, they are not real great at notifying their customers.

Sometimes, I check this site: https://downdetector.com/status/ups/

Although, I'm not sure how accurate it is.

Thanks,
Katie

Is there any way to adjust the timeout for the UPS requests?

I've seen multiple times in the past where UPS rates would either fail to return results, or be significantly delayed (> 30 seconds). The last outage I can recall lasted 3-4 days before UPS fully resolved it.

Sometimes it's UPS themselves. Other times it's the internet routes between your web server and their API endpoints. Once our twice we've even called the UPS account rep only to find out they weren't even aware of a systemwide outage. Until we called them <eyeroll>

Thanks for that info. We see intermittent UPS errors RE TLS and this info is helpful to explain it.

Depending your version of Able Gold, you may need to force ASP.Net to use TLS 1.2. Have you done that?

You've got it covered deeper than I have.

I just took a call from an account reporting same - UPS rates not coming back. Error log reports "The request was aborted: Could not create SSL/TLS secure channel"

It's definitely a TLS/Cypher issue, I've seen that error enough to be certain. Since TLS either works or doesn't work, my guess is UPS has fiddled with their cypher suites. Or their edge server proxies are messing up encryption in general.

Yet I've got another account UPS works just fine. Both are Server 2019. Both are .Net 4.8 framework targeted. Both have IISCrypto settings match. I even matched the live/dev urls to make sure they're the same as well.

So I compared my test AC 9 / Windows Server 2019 server, which I haven't used IISCrypto on yet, with my test and live AC Gold / Windows Server 2012 servers, which I did use IISCrpyto on. The registry key HKLM/Software/Policies/Microsoft/Cryptography/Configuration/SSL/00010002 didn't have any values on the 2019 server, but it had a Functions key with a bunch of cipher suites on the 2012 server. On my test 2012 server, I removed the Functions key and rebooted, and now UPS' servers complete the TLS connections and return rates. So I did the same on my live 2012 server, and I am getting rates again. FedEx and CyberSource connections are also still working.

OBLIGATORY WARNING: YOUR RESULTS MAY VARY - IF YOU TRY WHAT I DID YOU MAY NOT GET THE SAME RESULTS AND YOUR SITE MAY NOT WORK!

My server is sending different cipher suite options now, and UPS' server is choosing a different cipher suite for my connection now than it did when it was intermittently working yesterday. I haven't dug into the details, but that could be because the one it was able to use sometimes yesterday is not in the list my server is sending now (i.e. I haven't checked to see if there is any overlap in yesterday's list versus today's). I also haven't checked to see which of the options my server is offering are still considered "safe". I'm not too worried for the short term, because we use CyberSource's Secure Acceptance hosted form, meaning the customer's card info goes directly from their browser to CyberSource's servers, and we only get a token back.

Edited by user Tuesday, October 26, 2021 2:40:07 PM(UTC)  | Reason: Not specified

Yes, that's what I'm thinking as well. I know there are several other registry entries that IISCrypto changes (or that are related to TLS but aren't changes by IISCrypto). However, since I tried this first and it helped, I haven't spent time digging into the gory details for now.

Hi Jay,

I created a new forum category for Gold here in this forum. It's just too hard to remember to check both places. So the old forums will be available for searching, but any new posts should go to the new section -

https://www.ablecommerce...-and-older-versions-only

Hopefully this will be better for everyone, and we won't accidentally miss any posts.

Thanks for your help. We always appreciate your savvy tech answers!

I just got an email from a client with this info from UPS.
UPS is saying they made a change and one of 4 Ciphers need to be used when connecting. They said as they were updating their servers there would have been intermittent issues like we saw until today when it is now required on all servers.

ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES128-GCM-SHA256