Does CartThrob 2 use SSLv3 in it's Authorize.net payment gateway?

Question

Due to the POODLE vulnerability in SSLv3, Authorize.net is shutting down their support for SSLv3 on Nov 4, 2014. Here's a excerpt from the notice:

To that end, on November 4, 2014, we will be disabling the use of SSLv3 within our systems. This means that if your website or shopping cart solution uses SSLv3 to send transactions to Authorize.Net, you will no longer be able to process transactions. You will also no longer be able to access any secure Authorize.Net pages from IE6.

http://www.authorize.net/blog/?page_id=5561617

Do the Authorize.net payment gateway plugins in CartThrob 1 or 2 use SSLv3? How can I check to make sure?

Answer 1

From what I understand, CartThrob's Authorize.net gateway plugin uses curl to communicate with Authorize.net. What kind of SSL connection curl uses depends on your server's configuration, not CartThrob.

To test wether your server has SSL 3 enabled, you can use Qualys' SSL Server Test: https://www.ssllabs.com/ssltest/

This is also an excellent article about how to test for the POODLE vulnerability, disable SSLv3 support on your server, and protect yourself by disabling SSLv3 support in your browser.

SSL V3 GOES TO THE DOGS - POODLE KILLS OFF PROTOCOL
https://scotthelme.co.uk/sslv3-goes-to-the-dogs-poodle-kills-off-protocol/