Announcement: TLS 1.0 and 1.1 deactivation schedule on Demander systems

Dear partners,

We are moving forward with the plan to deprecate the insecure TLS 1.0 and 1.1 protocols. Below is the updated schedule, with deadlines, conditions of use and future measures.

---

✅ What has already been done

As of 7/28/2025, the domains below no longer accept TLS 1.0 or 1.1 connections:

• system.demander.com.br
• api.demander.com.br
• B2B stores *.pedido.la

---

🕒 Temporary support until 09/30/2025

The integration URLs:

• Busca-erp.demander.com.br
• shipping-erp.demander.com.br

Continues accepting connections with TLS 1.0 and 1.1 until 09/30/2025.

After this date, these URLs will only accept TLS 1.2 or 1.3.

---

🔁 URL to test compatibility tls-moderno.demander.com.br

So that you can check whether your system is prepared for the most modern versions, we created the address tls-moderno.demander.com.br which only works with TLS 1.1 and TLS 1.2.

⚠️Important: This domain must only be used for migration testing.

---

🔁 Temporary alternative: tls-antigo.demander.com.br

We created the address tls-antigo.demander.com.br which can be used from today and after 09/30/2025.

Basically you need to use this host in your integration with Demander.

⚠️Important: This domain is a temporary solution, intended for partners who have not yet been able to update their integrations.

---

💸 Maintenance fee from 01/01/2026

From January 1, 2026, continued use of the tls-antigo.demander.com.br domain will be subject to a fee of R$100.00 per month, per partner, to cover the additional costs and risks of maintaining this legacy environment.

---

❌ Final deactivation on 06/30/2026

The domain tls-antigo.demander.com.br will be definitely deactivated on 06/30/2026.

From that date on, it will no longer be possible to use TLS 1.0 or 1.1 on any Demander URL.

---

🛠️ Alternative after 06/30/2026

If your application still depends on TLS 1.0 or 1.1, you will need to implement an intermediate solution:

⚙️Create your own proxy that accepts TLS 1.0/1.1 and converts calls to TLS 1.2/1.3 before sending to Demander. (The Demander technical team can help you with this)

---

✅ What do you need to do now?

• If your integration already works with TLS 1.2 or higher, nothing changes. Not sure? Do a connection test pointing to the address tls-moderno.demander.com.br
• If you are still using TLS 1.0 or 1.1, update as soon as possible to avoid interruptions and extra costs.
• If you are unable to migrate by 09/30/2025, redirect your calls to tls-antigo.demander.com.br.

📌 Examples by language/technology

💻 Delphi

• Indy: use version 10.6.2 or higher.
• SecureBlackBox: use version with TLS 1.2 support.
• WinHTTP: configure WINHTTP_OPTION_SECURE_PROTOCOLS with TLS1.2.

☕ Java

• Java 6 or 7: no longer work.
• Java 8: use update 161 or higher.

System.setProperty(“https.protocols”, “TLSv1.2”);

🐘 PHP

• PHP < 7.1: may fail.
• Use PHP 7.2+ with OpenSSL 1.0.2+.
• Check curl_version() and phpinfo().

🧩 .NET / C#

• .NET < 4.5:incompatible.
• As of .NET 4.5:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

🌐 Python

• Use Python 3.6+.
• Python < 2.7.9 or < 3.4 does not support TLS 1.2 natively.

🏗️ Others

• cURL: curl –version should show TLSv1.2 support.
• Node.js: Versions 10+ support TLS 1.2/1.3.
• Windows (WinHTTP/WinINet): needs TLS 1.2 enabled in the Windows registry.

📌 Additional links

* Official notice from Serpro about disabling TLS on its systems.

* Tool to perform SSL testing: https://www.ssllabs.com/ssltest/analyze.html

* TLS Checker: https://www.site24x7.com/pt/tools/tls-checker.html

* Demander TLS check result: https://www.site24x7.com/tools/public/r/FT6TjB40XQrC/Ov0PZKkBmL2xvPZi35b3k1O0eNU8WYMvi3XiPTYeN4/OKdIThoi/Bxnve1tAus=