WinHttp TLS connection in classic asp

Question

I'm trying to send payment data to SagePay and, as they are turning off SSL, it needs to be sent using TLS.

The code I have is as follows:

set httpRequest = Server.CreateObject("WinHttp.WinHttprequest.5.1")
httpRequest.Open "POST", CStr(strPurchaseURL), false
httpRequest.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
httpRequest.send strPost
strResponse = httpRequest.responseText

I've been told that adding an option lets you set the protocol used but the only one I've found is:

httpRequest.option(9) = 2720

which allows for TLS and SSL but it can only be TLS, does anyone know what the code needs to be or is there something else I should be doing.

Also for reference there is a another poster with a [similar issue here](http://stackoverflow.com/q/29127018/692942). — user692942, Mar 18 '15 at 17:19

score 0 · Answer 1 · edited Mar 17 '15 at 12:36

0

Option 9 is WinHttpRequestOption_SecureProtocols which is

SSL 2.0: 0x0008
SSL 3.0: 0x0020
Transport Layer Security (TLS) 1.0: 0x0080

So

httpRequest.option(9) = &H80

edited Mar 17 '15 at 12:36

user692942

16,398
7
76
175

answered Mar 17 '15 at 12:06

Alex K.

171,639
30
264
288

That seems to be the right code but not sure if it's the right value. Still getting a: The supplied certificate has been revoked error from SagePay. – IanTrem Mar 17 '15 at 12:09
Check out [WINHTTP_OPTION_SECURE_PROTOCOLS](https://msdn.microsoft.com/en-us/library/windows/desktop/aa384066(v=vs.85).aspx) that seems to show there is more then just the three options - In fact it's more like six. Never been any good with bit flags if someone can workout what the values are. – user692942 Mar 18 '15 at 17:18
When I'm trying to read or write .Option(9), I'm getting "Invalid procedure call or argument". Other options (8, 10, etc) work well. Anybody knows why? – ulu Jul 12 '15 at 18:24

score 0 · Answer 2 · edited May 23 '17 at 12:06

0

If you are on Windows Server 2003 you may be having the same problem I was having - if you have access to the server, try the answer I added to my own question here: https://stackoverflow.com/a/29140418/1081692 and see how you get on.

edited May 23 '17 at 12:06

Community

1
1

answered Mar 19 '15 at 09:03

MikkyX

303
3
15

I need to check with the hosting company but I think you're right., Thanks! – IanTrem Mar 20 '15 at 08:28

WinHttp TLS connection in classic asp

2 Answers2

Linked