Transport Layer Security version 1.0 to be disabled on October 7, 2017

[#1]

Actions are required by Anaplan workspace administrators to update your Anaplan environment to support TLS versions 1.1 or 1.2.

Why is this change necessary?

Transport Layer Security (TLS) is a security protocol that provides privacy and security to applications that communicate with each other over a network. This protocol ensures that connections are made between the intended end points using encryption and identity verification.

As an older version, TLS 1.0 has several security vulnerabilities that are fixed in TLS 1.1 and 1.2. As a result, it is now considered standard security practice to disable TLS 1.0 for websites, web applications, and APIs and only support TLS 1.1 and TLS 1.2.

We are confident the improved security provided by transitioning support solely to TLS 1.1 and 1.2 is worth the minor inconvenience created by this change.

Actions required to avoid any disruptions to your Anaplan experience.

This change is effective as of October 7, 2017. If you have not carried out these steps, please do so as soon as possible to ensure that your organization is not affected.

Note that after this change, devices that run on iOS 8 or older and Android 5 or older are no longer supported.

1. Upgrade Anaplan Connect to Java 8 if your organization uses Java 6.x or 7.x with Anaplan Connect.
2. Test clients such as Anaplan Connect or custom integrations against the API URI with TLS 1.0 disabled. 
3. Upgrade browsers that do not support TLS 1.1 or higher.
4. Upgrade Anaplan Add-ins for Microsoft Office.

Below you’ll find additional details for each action item:

Step 1: Upgrade Anaplan Connect to Java 8 

Upgrade to Java 8 using one of these options if your organization uses Java 6.x or 7.x with Anaplan Connect: 

Option 1: Write a shell script that sets the JAVA_HOME environment variable to the location of the Java 8 Runtime Environment you want to use. 

Option 2: Contact Anaplan Support for a script to replace AnaplanConnect.bat or AnaplanConnect.sh. The replacement script ensures that you are using a supported version of Java for Anaplan Connect.

Option 3: If you have already installed Anaplan Connect, create your own replacement script:

1. Navigate to the Anaplan Connect directory. For example, on Windows the directory might be C:\anaplan-connect-1-3-3-3.
2. Make a backup copy of the script that calls Anaplan Connect:
   • Windows: Make a copy of bat and name that backup copy AnaplanClient.bat-OLD.
   • Linux/UNIX/MacOS: Make a copy of sh and name the backup copy AnaplanClient.sh-OLD.
3. Edit the script that calls Anaplan Connect:

• Windows:In bat replace "%JAVA%" with the version directory of Java 8 to use for Anaplan Connect.
• Linux/UNIX/MacOS:In sh to replace "${java}" with the version directory of Java 8 to use for Anaplan Connect.

	Windows .bat file	Linux/UNIX/MacOS .sh file
Original:	rem Start the Java virtual machine "%JAVA%" %JAVA_OPTS% -classpath "%CP%" com.anaplan.client.Program %*	# Start the Java virtual machine exec "${java}" ${JAVA_OPTS} -classpath "${classpath}" com.anaplan.client.Program "$@"
Change to Java 8:	rem Start the Java virtual machine "C:\Program Files\Java\jre1.8.0_66\bin\java" %JAVA_OPTS% -classpath "%CP%" com.anaplan.client.Program %*	# Start the Java virtual machine for MacOS involves /Library exec "/Library/Java/JavaVirtualMachines /jdk1.8.0_60.jdk/Contents/Home/bin /java" ${JAVA_OPTS} -classpath "${classpath}" com.anaplan.client.Program "$@"

The directory name on your computer might differ from these examples. For more information, see Data Integration on Anaplan Community.

Step 2: Test Clients

You can test clients such as Anaplan Connect or custom integrations by changing the API URI in your scripts to a URI that has TLS 1.0 disabled. This verifies whether your clients work with TLS 1.1 or higher.

To test your custom scripts:

1. Replace the API URIs in your custom scripts with the API test URI. For instance: -service https://api2.anaplan.com.
2. Run the scripts and confirm whether they ran successfully. (Note that because the test API server is used to verify if your client works on TLS 1.1+, you only need to send basic API requests from their client and not large volumes of data.)

Step 3: Upgrade Browsers

Upgrade browsers that do not support TLS 1.1 or higher. We recommend using the latest versions of Internet Explorer, Mozilla Firefox, Google Chrome, or Apple Safari.

Step 4: Upgrade Anaplan Add-ins for Microsoft Office

We have released a new version of both the Excel and Powerpoint Add-ins. Previous versions that use TLS 1.0 are no longer able to access Anaplan. If you still have previous versions, please follow the prompts to automatically download and update to the new version the next time you open Excel or Powerpoint. If you don't receive prompts or you prefer to download the latest versions manually, you can do so from the Anaplan Downloads form.

Questions, Comments, or Concerns?

Feel free to contact us at support@anaplan.com for further assistance.