Software Requirements

Fabrick Payment Orchestra software requirements concern the buyer's browser and the servers hosting the e-commerce site. The requirements include:

• TLS 1.2 protocol or newer versions\
• Accessibility of Fabrick endpoints in both test and production environments\
• Support for specific differentiated Cipher Suites for:
  • Receiving S2S notifications from Fabrick Payment Orchestra (incoming)
  • Using Fabrick Payment Orchestra services (outgoing)

---

Requirements for Merchant Servers

Cipher Suite Usage for Fabrick Payment Orchestra Services

To successfully call Fabrick Payment Orchestra services, your server must support the following ciphers:

- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_GCM_SHA384
- TLS_RSA_WITH_AES_128_CBC_SHA
- TLS_RSA_WITH_AES_256_CBC_SHA
- TLS_RSA_WITH_AES_128_CBC_SHA256
- TLS_RSA_WITH_AES_256_CBC_SHA256
- TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
- TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
- TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
- TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
- TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
- TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (active since 01/09/2022)
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (active since 01/09/2022)

---

Cipher Suites for Receiving S2S Notifications from Fabrick Payment Orchestra

To ensure the correct creation of a secure encrypted channel when receiving notifications via HTTPS, the merchant's servers must support at least one of the following Cipher Suites:

- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- TLS_RSA_WITH_AES_256_GCM_SHA384
- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_CBC_SHA256
- TLS_RSA_WITH_AES_256_CBC_SHA
- TLS_RSA_WITH_AES_128_CBC_SHA256
- TLS_RSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- TLS_DHE_DSS_WITH_AES_256_CBC_SHA
- TLS_DHE_DSS_WITH_AES_128_CBC_SHA
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

---

S2S Notification Format and Handling

The S2S notification from Fabrick Payment Orchestra is sent as a GET request with the following format:

Format

{{serverNotificationURL}}?a={{shopLogin}}&Status={{result}}&paymentID={{paymentID}}&paymentToken={{paymentToken}}

Example

url?a=GESPAY12345&Status=OK&paymentID=1234567891234&paymentToken=1ab234c5-67d8-48ef-a123-123a45678b9

A 200 HTTP status code must be immediately returned in response, without a body.

In case of error, the notification is retried twice per day (at 6:00 or 18:00) for the next 48 hours.

On the first attempt, the notification is sent using the protocol specified in the URL (HTTPS or HTTP). During retries, both protocols are attempted.

If after 48 hours all notification attempts fail, an email titled "Server to Server Communication Failure Report" is sent to the address configured in the BackOffice.

---

Incoming IP Address Management

In production, notifications are sent from:

• 213.218.32.48/29

In sandbox:

• 213.218.53.221/32
• 213.218.53.133/32

---

Reachability Test

The merchant’s server must be able to reach the following addresses.

Test Environment

PROTOCOL	URL
HTTP (port 80)	http://sandbox.gestpay.net/testhttp/test.asp
HTTPS (port 443)	https://sandbox.gestpay.net/testhttp/test.asp

Production Environment

PROTOCOL	URL
HTTP (port 80)	http://ecomms2s.iflla.it/testhttp/test.asp
HTTPS (port 443)	https://ecomms2s.iflla.it/testhttp/test.asp

Buyer Browser Requirements

Fabrick Payment Orchestra domains are associated with 256-bit SHA certificates and extended versions of SSL digital certificates issued by DigiCert.

Fabrick Payment Orchestra applies TLS 1.2 protocol or newer versions.

The buyer's browser must support this level of encryption and accept cookies and JavaScript.

Supported Desktop Browsers

Browser	Version
Chrome	>= 140
Safari	>= 18.6
Firefox	>= 143.0
Microsoft Edge	>= 140
Opera	>= 123

Supported Mobile Browsers

Operating System	Browser	Version
Android	Chrome	>= 140
iOS	Safari or any browser based on WebKit	>= 18.4