Important Change Information for Westpac Quickstream TLS Changes

As part of our initiative to conform to the new requirements issued by the Payment Card Industry Security Standard Council and cyber security best practice, we will be making changes to our web services that use TLS.

What TLSv1.2 and TLSv1.3 ciphers will we support after the cutover date?

TLSv1.3

TLSv1.2

How do I know if we are ready for this change? 

After Quickstream disables the CBC ciphers and enabled TLS v1.3, any connection to Qvalent/Westpac services must support the above ciphers. 

This change also impacts access to Westpac web sites and products such as: 

• Westpac Quickstream (including QuickWeb, QuickConnect, QuickVault, QuickView, QuickTerminal, QuickGateway, REST etc.)

• Westpac PayWay (including PayWay Net, API, Virtual Terminal etc.)

• Westpac iLink

• Westpac QuickSuper

• Westpac Payments Plus

• Westpac Invoice Finance

• Westpac BankRec

There two are different channels that need encryption to access Qvalent/Westpac services. These channels are:

• Internet Browser

• API integrations

An overview of each are below:

Internet Browsers

 When using most browsers, you will not have trouble accessing Qvalent/Westpac services. But you may have trouble if:

•  You are not using a modern supported browser.

•  Your browser has disabled the supported encryption protocols

To quickly test your browser compatibility, you can visit our test page, which has the new TLS settings implemented. 

If you are able to view the site without errors, access to services via your browser should not be impacted by this change. If you receive an error please speak with your IT department.,

API Integrations

After Quickstream disables CBC ciphers, any connection to Qvalent/Westpac services must use the above listed versions of TLS and Ciphers. 

API integrations are interfaces to Qvalent and Westpac services that are separate from, but use Qvalent and Westpac data. 

Examples of API integrations are:

• Secure token request for QuickWeb, QuickConnect, QuickVault, and PayWay Net.

• API requests for QuickGateway, QuickVault, PayWay API, REST API or iLink HTTPS/SOAP

1. Perform a API request to the test environment. 

   • If you do not receive a TLS handshake error message then the underlying TLS connection was successful using the updated ciphers.

PayWay

1. Point your test environment to connect to the PayWay. You may have implemented

   • PayWay Net with a secure token request, or

   • PayWay API

2. Perform a secure token request or API request using the TEST merchant. 

   • If you do not receive a TLS handshake error message then the underlying TLS connection was successful using the updated ciphers.

      

Quickstream

1. Re-instate your test environment to connect to the Qvalent/Westpac service test environment. You may have implemented 

   • a QuickWeb/QuickConnect/QuickVault with a secure token request, or

   • a QuickGateway

   • REST API

2. Perform a secure token request or API request to the test environment. 

   • If you do not receive a TLS handshake error message then the underlying TLS connection was successful using the updated ciphers. 

iLink HTTP File Transfers / Superannuation Messages

1. Re-instate your test environment to connect to the Qvalent/Westpac service test environment. You may have implemented 

   • a HTTPS file transfer or

   • a QuickSuper gateway message

2. Perform a HTTPS post to the test environment. 

   • If you do not receive a TLS handshake error message then the underlying TLS connection was successful using the updated ciphers.

When will Qvalent/Westpac disable CBC ciphers and enable TLSv1.3 in Production?

We plan to disable CBC ciphers and enable TLSv1.3 encryption according to the following schedule:

• Note, dates are subject to change.

Frequently Asked Questions

How do I evaluate whether my HTTPS connectivity contains cryptography which is compatible with the changes Westpac is making?

Westpac advises customers to perform a full UAT test against our Test/Support environment to confirm this change will not cause any issues for your integrations.

What if my HTTPS implementation breaks?

Customers will be required to use iLink as a BCP option for the delivery of their files between your financial systems and Westpac
This will be communicated by our helpdesk to customers who are having issues with their connectivity. Our helpdesk will be on hand to assist customers who have issues instigating iLink BCP as a priority.
Westpac will be unable to roll this change back

Can I be granted an extension for this change?

No, extensions cannot be granted for this change.
As this change affects the cryptography offered to all customers via our web services, all customers must be prepared for this change simultaneously for this change to occur.

Will there be a way to continue using the old cryptographic standards

No, the above-mentioned cryptographic functions will be disabled.

My implementation solution does not involve credit card data and therefore is not subject to PCI-DSS. Does this change still apply to me?

Yes, this change will apply to all HTTP customers that connect to the Westpac (Qvalent) web services. This is not only a PCI-DSS requirement, but also best industry practice.

Contact Us

Email mailto:quickstream@qvalent.com or phone the Helpdesk team on 1300 726 370 between 7:00am and 7:00pm (AEST), Monday to Friday.

Disclaimer

These guidelines are general in nature and have been prepared without knowledge of the specific environment in which your systems operate. These guidelines are current at the time of writing, but may require update over time. Except where contrary to law, Westpac intends by this notice, to exclude liability for these guidelines and the information contained in them. While Westpac has made every effort to ensure these guidelines are free from error, Westpac does not warrant their accuracy, adequacy or completeness.