TLS Security Standards

To protect transaction data and support your compliance efforts, the platform enforces Transport Layer Security (TLS) and cipher suite standards for API services.

Configure every system that connects to the API to meet these requirements. The platform rejects connections that use deprecated protocols or weak ciphers at the network level.

Supported Protocols

Partner systems must support TLS 1.2 or TLS 1.3 for all encrypted HTTPS traffic and webhook endpoints.

Supported: TLS 1.2, TLS 1.3
Deprecated / Blocked: SSL v2, SSL v3, TLS 1.0, TLS 1.1

⚠️
Action required for legacy systems
If your application runs on an older framework or legacy runtime (e.g., .NET Framework < 4.7, Java < 8, or OpenSSL < 1.0.1), you may need to explicitly enable TLS 1.2+ in your HTTP client configuration before sending requests.

Supported Cipher Suites

Your HTTP clients and receiving webhook servers must be able to negotiate TLS 1.2 or TLS 1.3 using one of the supported cipher suites below.

Note: This list can change as security standards evolve and older cipher suites become unsafe. Keep your dependencies current and allow your HTTP client to negotiate supported cipher suites.

TLS 1.3 Ciphers

TLS_AKE_WITH_AES_128_GCM_SHA256
TLS_AKE_WITH_AES_256_GCM_SHA384
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256

TLS 1.2 Ciphers

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_256_CBC_SHA256

📘
Avoid certificate and cipher pinning
Modern HTTP client libraries and SDKs negotiate supported cipher suites automatically. Do not hardcode or pin a cipher suite because the allowed suites can change as security standards evolve.

Do not pin certificates. Stax uses certificate authorities and network endpoints that can change over time. If your compliance program requires pinning, contact support for root or intermediate certificates. Pinning a leaf certificate can cause a service outage.

Testing Compatibility

You can verify whether your integration stack meets our network security requirements prior to go-live using standard command-line tools.

Command Line Test

Run these cURL commands to test your client's TLS negotiation. Replace the URL with an API endpoint that your integration can access.

# Test a TLS 1.2 connection.
curl -v --tls-max 1.2 https://your-api-endpoint.com/v1/health

# Test a TLS 1.3 connection.
curl -v --tlsv1.3 https://your-api-endpoint.com/v1/health

A successful connection shows a TLS version of TLSv1.2 or TLSv1.3 in cURL's verbose output. If your HTTP client negotiates below TLS 1.2 or uses an unsupported cipher suite, it receives a connection error such as SSL_ERROR_UNSUPPORTED_PROTOCOL or connection reset by peer.

Webhook Requirements

If your integration receives outbound webhooks from our platform, your receiving endpoints must also serve a valid SSL/TLS certificate supporting TLS 1.2+ and one of the approved cipher suites above. We support wildcard certificates from recognized public Certificate Authorities (CAs); self-signed certificates are prohibited.