Overview

Starting September 30 2023, Amazon will no longer accept TLS 1.0 or TLS 1.1 for the URLs generated by the createFeedDocument, getFeedDocument, and getReportDocument calls. The restriction applies to every marketplace and every version of the Feeds and Reports APIs. Sellers whose integrations still rely on these legacy encryption protocols will see connection failures unless they move to TLS 1.2 or newer.

Key Points

• Cut‑off date — After September 30 2023, any attempt to negotiate TLS 1.0 or TLS 1.1 with the document URLs will be rejected, irrespective of API version.
• Targeted endpoints — The pre‑signed HTTPS links returned by createFeedDocument, getFeedDocument, and getReportDocument are the only Amazon URLs that will enforce the TLS 1.2 minimum.
• Global enforcement — The rule covers all Amazon marketplaces, from the United States to Japan, so no region is exempt.
• Security motivation — TLS 1.0 and TLS 1.1 are widely regarded as vulnerable to downgrade attacks and cipher‑suite weaknesses; upgrading to TLS 1.2 aligns Amazon with current industry best practices.
• Immediate symptom — Integrations that depend on default system libraries still locked at TLS 1.0/1.1 will start returning HTTP 400 or 403‑style errors when they call the affected operations.

How the TLS Deprecation Works

1. Requesting a document URL — When a seller invokes createFeedDocument or getReportDocument, Amazon replies with a time‑limited, pre‑signed HTTPS link. Post‑deadline, the server will only complete the TLS handshake if the client offers TLS 1.2 or higher; a client presenting TLS 1.0/1.1 receives a handshake failure. Example: A Python automation script that still uses urllib3 v1.22 (which defaults to TLS 1.0) tries to upload a feed on October 2 2023 and logs “SSL handshake failed”.
2. Uploading or downloading the document — The seller’s system then uses the supplied URL to PUT a feed file or GET a report. The TLS version is negotiated at this stage; if the underlying library cannot speak TLS 1.2, the transfer aborts instantly. : A Java batch job running on JDK 1.7 (TLS 1.0 only) attempts to pull a performance report and throws a javax.net.ssl.SSLHandshakeException.