Update to AWS: SSL discontinued

Popar-Toys · Apr 24, 2015

Received this email today. Does anybody know if usage of WWWs will still be functional after the change?

Dear AWS Customer,

This message explains some security improvements in our services. Your security is important to us. Please review the entire message carefully to determine whether your use of the services will be affected, and if so what you need to do.

As of 12:00 AM PDT May 20, 2015, AWS will discontinue support of SSLv3 for securing connections to S3 buckets. Security research published late last year demonstrated that SSLv3 contained weaknesses in its ability to protect and secure communications. These weaknesses have been addressed in Transport Layer Security (TLS), which is the replacement for SSL. Consistent with our top priority to protect AWS customers, AWS will only support versions of the more modern TLS rather than SSLv3.

You are receiving this email because some of your users are accessing Amazon S3 using a browser configured to use SSLv3, or some of your existing applications that use Amazon S3 are configured to use SSLv3. These requests will fail once AWS disables support for SSLv3 for the Amazon S3 service.

The following bucket(s) are currently accepting requests from clients (e.g. mobile devices, browsers, and applications) that specify SSLv3 to connect to Amazon S3 HTTPS endpoints.

[mybucketname] : us-east-1, [mybucketname] : us-east-1, [mybucketname] : us-east-1

For your applications to continue running on Amazon S3, your end users need to access S3 from clients configured to use TLS. As any necessary changes would need to be made in your application, we recommend that you review your applications that are accessing the specified S3 buckets to determine what changes may be required. If you need assistance (e.g. to help identify clients connecting to S3 using SSLv3), please contact our AWS Technical Support or AWS Customer Service.

For further reading on SSLv3 security concerns and why it is important to disable support for this nearly 18 year old protocol, we suggest the following articles:

https://www.us-cert.gov/ncas/alerts/TA14-290A
https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
http://disablessl3.com/#why

Thank you for your prompt attention.

Sincerely,
The Amazon Web Services Team
Click to expand...

Graham-Dunnett · Apr 24, 2015

On web player builds WWW is mapped to the browser. An https request therefore uses the client and whatever it's set up to use.

Popar-Toys · Apr 24, 2015

Graham Dunnett said: ↑

On web player builds WWW is mapped to the browser. An https request therefore uses the client and whatever it's set up to use.
Click to expand...

What about from mobile builds, specifically AND/iOS ?

Uzi187 · Apr 29, 2015

Same issue here. Is there anyway to set the protocol when we make the call? (Talking about iOS, Android and Windows Phone)

@Popar Toys : Did you find anything?

Uzi187 · May 7, 2015

Anyone????

Search Unity

Update to AWS: SSL discontinued

Popar-Toys

Graham-Dunnett

Administrator

Popar-Toys

Uzi187

Uzi187

Search Unity

Unity ID

Useful Searches

Update to AWS: SSL discontinued

Popar-Toys

Graham-Dunnett

Administrator

Popar-Toys

Uzi187

Uzi187