Environment URLs & IP Addresses

You must provide the URL of a OneSpan Sign server.

If you are exploring the system or performing tests, you can connect to our Sandbox environment. Alternatively, if you have completed your integration with our system and want to launch your product, you can connect to our Production environment.

Sandbox Accounts are not equivalent to Production Accounts. To connect to the OneSpan Sign Production Environment, you must purchase a Production Account.

Your configuration settings depend on the URL into which you log. If you aren't sure which URL to use, in the email you received when you signed up, click Log into your account. In the Login screen that appears, your login URL will appear in your browser's address bar.

To ensure continuous service, you must whitelist certain IP addresses. To see which IP addresses need to be whitelisted, consult the tab for your environment.

New Incoming IP Whitelists for OneSpan Sign

Please review this section to ensure your OneSpan Sign service continues to function normally.

In order to further optimize the security posture of OneSpan Sign, we made the following changes:

1. We introduced a Web Application Firewall (WAF) and additional protection against Denial-of-Service attacks. This protection is provided through Cloudflare and we switched the inbound IP addresses used by OneSpan Sign to CloudFlareIP addresses.

2. We enhanced the TLS cipher suites supported by OneSpan Sign. Transport Layer Security (TLS) is a protocol that protects the confidentiality and integrity of data exchanged between OneSpan Sign and customers. For more information, see TLS Support.

Please read below for more details about these changes:

What do I need to do?

If you are not whitelisting IPs in your integration, there is no action required on your part.

If you are whitelisting our public IPs, please add the respective FQDN (fully qualified domain name) to your inbound whitelist to continue accessing our services:

Environment	FQDN
Canada Sandbox	sandbox.e-signlive.ca
US2 Sandbox	sandbox.esignlive.com
US1 Sandbox	sandbox.e-signlive.com
Europe Production	apps.esignlive.eu
Canada Production	apps.e-signlive.ca
US2 Production	apps.esignlive.com
US1 Production	apps.e-signlive.com
Australia Production	apps.esignlive.com.au

If your Security policy does not permit FQDN whitelisting, see Cloudflare's IP ranges. These IPs are subject to change at Cloudflare's discretion.

IP whitelisting for outgoing IP addresses is not impacted by this change and is still required.

Support for IPv6 on the AU Production environment was dropped on October 3, 2021.

Below is the list of New Incoming IP addresses (IPv4) applicable to all environments:

• 173.245.48.0/20

• 103.21.244.0/22

• 103.22.200.0/22

• 103.31.4.0/22

• 141.101.64.0/18

• 108.162.192.0/18

• 190.93.240.0/20

• 188.114.96.0/20

• 197.234.240.0/22

• 198.41.128.0/17

• 162.158.0.0/15

• 104.16.0.0/13

• 104.24.0.0/14

• 172.64.0.0/13

• 131.0.72.0/22

Changes to TLS cipher suites

At the same time as the above-mentioned IP switch, we updated the TLS configuration used by OneSpan Sign. OneSpan Sign now uses the following TLS versions and cipher suites:

TLS 1.2 cipher suites

• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-SHA256
• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-RSA-AES256-SHA384
• AES128-GCM-SHA256
• AES128-SHA256
• AES256-GCM-SHA384
• AES256-SHA256

TLS 1.3 cipher suites

• TLS13-CHACHA20-POLY1305-SHA256

• TLS13- AES-256-GCM-SHA384

• TLS13- AES-128-GCM-SHA256

What do I need to do?

We recommend that you start working with your IT team immediately to upgrade your integration framework to the latest security library supporting the above-mentioned TLS versions and cipher suites. Once completed, please test your OneSpan Sign Sandbox environment to ensure that all TLS communications are working properly. This is an important step that ensures that your organization does not encounter service disruptions:

URL Update for OneSpan Sign Sign API Calls

What do I need to do?

If you have not integrated OneSpan Sign via our API/SDKs and are not using mutual TLS protocols in your integration, there is no action required on your part.

If you HAVE integrated OneSpan Sign via our API/SDKs and are using mutual TLS protocols, in addition to the requirement of switching the IP addresses used by OneSpan Sign to IP addresses of Cloudflare as described above, please change your integration from using port 8443 to using a path.

For example:

Old	New
https://apps.esignlive.com:8443/api	https://apps.esignlive.com/mtls/api

We also recommend that you start working with your IT team immediately to upgrade your integration framework to the latest security library using strong ciphers. Once completed, please test your OneSpan Sign Sandbox environment to ensure that all TLS communications work properly. This is an important step that ensures that your organization does not encounter service disruptions:

Your configuration settings depend on the URL into which you log. If you aren't sure which URL to use, in the email you received when you signed up, click Log into your account. In the Login screen that appears, your login URL will appear in your browser's address bar.

To ensure continuous service, you must whitelist certain IP addresses. To see which IP addresses need to be whitelisted, consult the tab for your environment:

• U.S .

• U.S. Government

• Canada

• Australia

• Europe