SSL Certificates

[outeredge2]

Do you need an SSL if you are using Paypal as your only payment source?

Isn't the purpose of an SSL just to secure a site and encruypt the CC data when processing the order direct on ur site?

[Vger]

You still need an SSL Certificate, and a Full SSL is best for customer confidence.

This will encrypt data entered in the Create Account, Account Edit areas etc. (thereby protecting customer data), the Checkout Process, including transit to Pay Pal - and you can use it to lock down your Zen Cart 'admin' folder.

Vger

[outeredge2]

You still need an SSL Certificate, and a Full SSL is best for customer confidence.

This will encrypt data entered in the Create Account, Account Edit areas etc. (thereby protecting customer data), the Checkout Process, including transit to Pay Pal - and you can use it to lock down your Zen Cart 'admin' folder.

Vger

Are there any SSL providers that are recommended?

Apparently 1and1 only allows you to use their companies SSL (which is through GEOtrust) but Godaddy has full SLL's for $12.95 yr and through 1and1 it is $49.95!

[Vger]

What you can do about SSL Certificates does depend on what your hosting company allows. I don't know but 1and1 may only allow SSL Certificates which they buy and install on their hosting - not allowing you to get a dedicated ip address for your site from them and then install your own certificate. If that's the case then you're stuck with what they offer.

If you have the choice then I'd recomend Comodo, because their Certificates work for both www.yourdomain.com and for just yourdomain.com - which I know does not apply with GeoTrust.

We haven't used GoDaddy in years, and even then only for test websites, so cannot comment on how much traffic they can handle.

Vger

[outeredge2]

What you can do about SSL Certificates does depend on what your hosting company allows. I don't know but 1and1 may only allow SSL Certificates which they buy and install on their hosting - not allowing you to get a dedicated ip address for your site from them and then install your own certificate. If that's the case then you're stuck with what they offer.

If you have the choice then I'd recomend Comodo, because their Certificates work for both www.yourdomain.com and for just yourdomain.com - which I know does not apply with GeoTrust.

We haven't used GoDaddy in years, and even then only for test websites, so cannot comment on how much traffic they can handle.

Vger

Thanks for that. Helps greatly!

[frank18]

.....
If you have the choice then I'd recomend Comodo, because their Certificates work for both www.yourdomain.com and for just yourdomain.com - which I know does not apply with GeoTrust.
....

That is really irrelevant.

Reason being: you define your HTTPS_SERVER etc to either www.yourdomain.com or to yourdomain.com (without the www).

Zencart uses these constants to automatically switch to the specified www or non-www when going into secure mode.

As long as this matches the parameters of your SSL certificate, you will not have a problem.

In that respect it really would not matter if you use Comodo or GeoTrust.

When I set up my SSL certs I had my criteria set on encryption (ie 2048) and price (shop around).

[Vger]

It's most certainly not irrelevant as to whether your Cert covers both addresses or not. And as the ones which do cover both addresses cost the same as the ones which only cover one type of address then why would you buy an inferior product?

Yes, the Zen Cart config files cover which form of address is used once people reach your site and start clicking through it, but:

1. The site owner may wish to change their base https address from one to the other. I've seen that happen a lot. It's not a rarity.

2. A previous visitor to your site may just type in https://yourdomain.com - and get a security warning. Not good! In another thread on this forum in the past few days someone bought a Geo Trust SSL which only covered www.yourdomain.com and when anyone typed in https://yourdomain.com they got a server landing page with a warning not to proceed (the certificate for that address was the server certificate).

Vger