This notification is to remind you that RESTlet and SuiteTalk web services requests in some NetSuite accounts still use obsolete cipher suites. These obsolete cipher suites are no longer considered secure. In addition, this notification is to remind you that Elliptic Curve Cryptography (ECC) certificates have been deployed on RESTlet and SuiteTalk account-specific domains. The discovery domains for RESTlet and SuiteTalk have used ECC certificates for some time.
What is Changing?
You must update your clients to support ECC certificates and to use more secure cipher suites before February 10, 2021. RESTlet and SuiteTalk web services domains use ECC certificates with key size of 256 bits (P-256 curve).
Required Actions
In all your NetSuite accounts, including your production, sandbox, test drive, and development accounts, you must update the clients on your servers to support ECC certificates, and you must remove obsolete cipher suites.
To view the list of supported cipher suites, see the help topic Supported TLS Protocol and Cipher Suites, SuiteAnswers ID 84138.
You must remove the obsolete cipher suites and implement support of server ECC certificates with a P-256 key no later than February 10, 2021.
To verify whether your client is compliant with requirements to support the ECC certificates with a P-256 key, make a discovery call to either rest.netsuite.com or webservices.netsuite.com. If you receive a successful response from these services, then your client meets the necessary requirements for secure communication (https://) that uses the TLS protocol.
For more details about discovery calls, see Dynamic Discovery of URLs for SOAP Web Services and RESTlet Clients in the help topic Understanding NetSuite URLs, SuiteAnswers ID 42541.
If you have any questions, please contact NetSuite Customer Support.
