Change SagePay urls in Configuration.cs due to SagePay being taken over

[jchannon]

Hi Jeremy

SagePay has been taken over by Elavon and they are retiring the urls. The new URLS are:

Testing Environment:
https://sandbox.opayo.eu.elavon.com/gateway/service/vspserver-register.vsp

Live Environment:
https://live.opayo.eu.elavon.com/gateway/service/vspserver-register.vsp

I've cloned the repo and changed the Configuration.cs and tried to run the sample app.

I'm getting a TLS error due to potentially this project targeting .NET 4.

I've tried to update the .NET target the projects compile on but same error:

The request was aborted: Could not create SSL/TLS secure channel.

request.ContentLength = requestData. Length;

using (var stream = request.GetRequestStream()) {
stream. Write(requestData, 0, requestData. Length);

I've also tried to force the security protocol in HttpRequestSender.cs but still the same error.

My machine is pretty ropey and was wondering if you're able to test it with the url changes to see if you can get any further?

Thanks

[markembling]

In my experience, re-targeting the project to >= .NET 4.7.2 solves the TLS issue as it'll use TLS 1.2 then automatically. That is the project which is using SagePayMvc, not SagePayMvc itself - so in your specific example, that'd be the sample app like you said. I think this might also depend on the version of Windows that is in use, but I'm not sure of the specifics off the top of my head.

However I have also been in the same position as you (an older .NET 4 app running on an older Windows Server 2008 box) and in that instance, I added the following code to Application_Start in Global.asax.cs:

ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;

The following links are useful for a bit more detail surrounding this (including caveats).

• TLS 1.2 #24
• https://support.quovadisglobal.com/kb/a433/how-to-enable-tls-1_2-on-windows-server-2008-r2.aspx
• https://stackoverflow.com/questions/41478506/issue-to-use-tls-1-2-in-net-framework-4-0
• https://docs.microsoft.com/en-us/officeonlineserver/enable-tls-1-1-and-tls-1-2-support-in-office-online-server#enable-strong-cryptography-in-net-framework-45-or-higher

Regarding the URLS, I can confirm that the change you mention should work. I haven't personally done exactly the same as you (i.e. updating the sample app and testing that) but I have tested my own existing app whilst referencing a custom build of SagePayMvc containing the changes against the Elavon test environment.

However, related to this, you'll also need to update the refund URLs, assuming you need that functionality. The communication about that part frankly could have been a little bit better IMO. I've got a fork of this repo and these are the two commits that deal with URLs:

• markembling@1888b62
• markembling@e1464ca

The relevant pages on the Elavon site are:

• https://developer.elavon.com/products/opayo-server/v1/test-and-live-urls-4515
• https://developer.elavon.com/products/opayo-shared-api/v1/urls-4714 (this covers other things out of scope in regards to SagePayMvc)

I do of course plan to contribute the changes back into this main repo but I'm also wanting to move to protocol v4.00 before doing that and that's not 100% ready to go just yet. In the meantime though, hopefully this answer helps you.

[jchannon]

Hi Mark,

I'm glad I'm not the only one that has hit this. The dev machine is Win8, I've not tested it on the prod server which is Win 2012 Server.

As I say I've added code ServicePointManager.SecurityProtocol = Tls12 but it didn't make a difference and retargeted to .NET 4.6.2 and I'm wondering if the OS is the issue.

I'm tempted to create a new machine with Windows 11 on it and latest .NET framework and target the latest and see if it still compiles and runs.

Glad to hear just changing those URLs fixes the main issue though!

[JeremySkinner]

I'm not maintaining this anymore I'm afraid, but if one or both of you want to take it over let me know

[jchannon]

I might be interested in that and as part of challenge to myself I'm playing around with it and I have some questions that I'll raise as issues if that's ok.

[jchannon]

I have this compiling (on my fork) with the Config URLs just changed and it worked.

For a challenge I also have it compiling and tests passing against .NET8.

[JeremySkinner]

@jchannon I've sent you an invite to collaborate on the repo

[jchannon]

👍 thanks!