Question:

What is Transport Layer Security (TLS), and what versions of TLS does Everbridge support?

Answer:

TLS, or Transport Layer Security, is a protocol that provides privacy and data integrity between two communicating applications. It is the most widely deployed security protocol used for web browsers and other applications that require data exchange.

Currently Everbridge supports TLS 1.2 and TLS 1.3.

Starting on March 1, 2023, the list of TLS 1.2 ciphers supported by Everbridge will be:

• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-ECDSA-AES256-GCM-SHA384

Starting on February 1, 2023, the list of TLS 1.3 ciphers supported by Everbridge will be:

• AES_128_GCM_SHA256
• AES_256_GCM_SHA384
• CHACHA20_POLY1305_SHA256

What does this mean to you?

With the use of the stronger encryption protocols and algorithms, we no longer officially support TLS 1.1 and certain weak ciphers in TLS 1.2 in any of our applications.

If you continue to use browsers that do not support the strong TLS 1.2 and 1.3 ciphers listed above, some new and/or existing features and functionality may no longer work. Bugs or performance issues that appear only when using TLS 1.1 or weaker unsupported ciphers in TLS 1.2 will not be investigated or fixed by Everbridge.

How does Everbridge decide which TLS versions or Ciphers to support?

Everbridge’s security framework is based on the comprehensive set of security requirements and controls within US National Institute of Standards and Technology (NIST) Special Publication 800-53 revision 4: Security and Privacy Controls for Information Systems and Organizations. See the link below for a full list of supported TLS versions and ciphers. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf 

What action do you need to take?

Everbridge is taking every step to ensure that the supported browsers (i.e., Google Chrome, Mozilla Firefox, Internet Explorer 11+, Edge) will continue to work after the February 1, 2023 update. If you use older browser versions which do not by default support the latest encryption protocol, then we recommend that you upgrade to a newer version. For more information on troubleshooting browser issues when using non-supported TLS versions or ciphers, see knowledge base article 51305 - Troubleshooting Client-Side TLS Error Messages That Can Occur When Using Non-supported TLS Versions or Ciphers

How will this affect Everbridge mobile apps?

Everbridge mobile apps will not be affected by this upgrade.

How will this affect uploads via Secure FTP (SFTP)?

Contact file uploads connecting via SFTP will not be affected by this upgrade.

How will this affect my application integrating with the Everbridge Open API?

If your organization utilizes the Everbridge Open API for automation, you may also need to ensure that your API client software can connect to the stronger encryption protocols and algorithms after the February 1, 2023 update.