Dears
when I try to verify a domain
its show this error
" Domain verification failed. Review your TLS Certificate configuration to confirm that the certificate is accessible and a supported TLS Cipher Suite is used. "
I'm using Cloudflare SSL certification
Yes, it looks like either the Apple Pay servers cannot access your certificate or it was not able to be used for Apple Pay on the Web due to the Cipher Suites on the certificate.
1) Make sure the domain you are verifying is not behind a proxy.
2) That your certificate is using at least TLS 1.2 with one of these Cipher Suites (Prefer Elliptic Curve):
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
3) If your domain is not publicly accessible you may need to provide access to these IPs for verification:
17.32.139.128/27
17.32.139.160/27
17.140.126.0/27
17.140.126.32/27
17.179.144.128/27
17.179.144.160/27
17.179.144.192/27
17.179.144.224/27
17.253.0.0/16
4) If you are unable to find the issue try setting the server access logs to verbose and retrying the domain verification. The logs should tell you where the breakdown is.
Setting Up Your Server
https://developer.apple.com/documentation/apple_pay_on_the_web/setting_up_your_server
Matt Eaton
DTS Engineering, CoreOS
meaton3 at apple.com
You say "Prefer Elliptic Curve". But all cipher suites you listed are RSA ones.
You are correct, this list is old. I was recently part of an effort to get this list updated to the current one that includes RSA and Elliptic Curve Ciphers (r. 70349430).
See the updated list here.
Regarding:
However domain verification fails and our server log says "none of the cipher suites supported by the client application are supported by the server". Please advise
If you are unable to work through this, please open a TSI and I can look deeper into this. Please reference this Forums post on your incident.
Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
We have an incident open for over a week, its number is 770249757
Yeah, I did not see 770249757 anywhere in the DTS system.
Regarding:
Here is a TSI case ID: 101414548327 Dear Matt. We're still waiting for any reaction on the Technical Support ticket from Jun 22. BTW its ID is 101417655497
This is also not a DTS Incident number: 101417655497. This is another team here at Apple, but I am unable to see which one.
What is the status of the issue? Are you still not able to get your domain verified?
Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
You can open a TSI, or a Code-Level Support incident, here.
Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
A short summary for this issue.
Apple server uses insufficient set of cypher suites:
So if anybody else uses ECC certificate be aware the suites above are all RSA.
Going to submit a bug report now.
Hi I was facing similar issue.
Simple Solution which worked for me Add a Intermediate chain of SSL certificate on your server.
For example, on Apache add certificate chain and add to your configs SSLCertificateChainFile /etc/pki/tls/certs/chain.crt