WinHttp TLS connection in classic asp

Question

I'm trying to send payment data to SagePay and, as they are turning off SSL, it needs to be sent using TLS.

The code I have is as follows:

set httpRequest = Server.CreateObject("WinHttp.WinHttprequest.5.1")
httpRequest.Open "POST", CStr(strPurchaseURL), false
httpRequest.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
httpRequest.send strPost
strResponse = httpRequest.responseText

I've been told that adding an option lets you set the protocol used but the only one I've found is:

httpRequest.option(9) = 2720

which allows for TLS and SSL but it can only be TLS, does anyone know what the code needs to be or is there something else I should be doing.

Speight

Also for reference there is a another poster with a similar issue here. – Coom

Answer 1

Option 9 is WinHttpRequestOption_SecureProtocols which is

SSL 2.0: 0x0008
SSL 3.0: 0x0020
Transport Layer Security (TLS) 1.0: 0x0080

So

httpRequest.option(9) = &H80

Pelagias

That seems to be the right code but not sure if it's the right value. Still getting a: The supplied certificate has been revoked error from SagePay. – Speight

Check out WINHTTP_OPTION_SECURE_PROTOCOLS that seems to show there is more then just the three options - In fact it's more like six. Never been any good with bit flags if someone can workout what the values are. – Coom

When I'm trying to read or write .Option(9), I'm getting "Invalid procedure call or argument". Other options (8, 10, etc) work well. Anybody knows why? – Decarbonize

Answer 2

If you are on Windows Server 2003 you may be having the same problem I was having - if you have access to the server, try the answer I added to my own question here: https://mcmap.net/q/1171820/-classic-asp-iis6-win2003-server-can-39-t-communicate-with-tls-server and see how you get on.

Shown

I need to check with the hosting company but I think you're right., Thanks! – Speight