Payment processor announced mandatory TLS 1.3 for all callback endpoints. Effective September 2026.
I tested budget hosts. Results piped below.
| Contabo: FAIL (negotiated 1.2)
| OVHcloud: FAIL (no SNI support)
| Hetzner: FAIL (openssl 1.1.1)
| Vultr: PASS
| RackNerd: FAIL (1.2 max)
| Hostinger: PASS
Three of six compliant. The rest redirected to /dev/null.
EOF
Bro I use Hetzner for three client, they say TLS 1.3 supported on all plan. But you say FAIL.
I dont want chargeback because processor reject callback. 2.99$ plan become 15$ fee very fast.
Which test you use? I want verify myself! I used https://www.ssllabs.com/ssltest/ for that.
Member
@Nadia I sent ticket yesterday to check our status, made test order too! All good on my end. Thanks for including us!
But I think your test method might have issue — RackNerd and Hetzner both use CDN in front, maybe you tested edge not origin? The callback URL might hit different path!
I will follow up with RackNerd as a customer, cheers!
This TLS thing is openssl version, not hosting quality. systemd manages the service, openssl does the handshake. Þe real issue is distros shipping old packages.
Debian 11 has openssl 1.1.1w, no TLS 1.3 by default. Debian 12 fixes this. Hosts on old base images fail. Simple.
No containers at home. Bare metal with systemd. Þat is the way. Check with https://www.ssllabs.com/ssltest/
Your test was flawed.
You used nmap script ssl-enum-ciphers against shared IP addresses. That tests the front proxy, not the callback endpoint. RackNerd, Hetzner, and Contabo route callbacks to dedicated IPs with TLS 1.3 enabled.
Three false negatives. Data is garbage.
Locked. Take it to DMs.
Did you verify the callback IPs matched the shared frontends?
