Do I need purchase SSL license? The PxPay payment module cannot connect DPS gate way

[benxp]

I need HELPs!!!!!

I set up the website with zencart and installed the pxpay plugin to accept the credit card payment via DPS. But since lastw week, the PXpay module cannot connect to DPS gateway, everytime it say "The selected payment type is currently not available." I contacted DPS they said they can see there is no any issue at their side but they have disabled SSL 3.0 and only TLS will be available now. Also they will upgrade from SHA-1 to SHA-2 later.

Link as below:

https://www.paymentexpress.com/News/..._0_Deprecation

and another:
https://www.paymentexpress.com/News/...SHA-1_with_SHA


I contact my website hosting for helps but they said the issue is Signature algorithm SHA1 is weak and they will ugrade it to SHA2 but as its wildcard shared SSL and it will take time because many of their shared server didn't support SHA2 because of OS version so they can't deploy it yet. They are asking me to purchase a SSL license and also a dedicated IP. Total price will be $170 usd a year.

Is this charge reasonable? Why do we need a standard license for TLS ?

I am considering to change a new webhosting, but do your guys have any idea what kind of webhosting can work for DPS and no hassle in future? How can I indentify a plan will be working for us?

I know little about this kind of security information, Appriciate for any helps from your guys!!!

[bislewl]

A SSL won't help it's an issue with the module.

I have modified the module to solve the issue, and should be uploading it soon.

[bislewl]

I submitted the new version, should move through moderation by the ZenCart Team without issue

[benxp]

Awsome!!! is there any dowload link available at the moment?

[benxp]

Hi Bislewl, my guys solved the problem but many thanks for your help!!!

[00falcon]

Hi Bislewl, my guys solved the problem but many thanks for your help!!!

Hi,
i have just noticed that i have the same problem...
Can you point us in the right direction to solve this...?

[bislewl]

Hi,
i have just noticed that i have the same problem...
Can you point us in the right direction to solve this...?

I updated the module http://www.zen-cart.com/downloads.php?do=file&id=658
Unfortunately I forked and did a merge request on github but before I posted it to Zen-Cart.com, the original author posted my commit to Zen-Cart.com.
So he got the credit At least the community will benefit, which is my overall goal

But all I did was:
in includes/modules/payment/dps_pxpay.php
Line 594 added the "//"

//       curl_setopt($curl, CURLOPT_SSLVERSION, 3); 

[umdiecker]

I updated the module http://www.zen-cart.com/downloads.php?do=file&id=658
Unfortunately I forked and did a merge request on github but before I posted it to Zen-Cart.com, the original author posted my commit to Zen-Cart.com.
So he got the credit At least the community will benefit, which is my overall goal

But all I did was:
in includes/modules/payment/dps_pxpay.php
Line 594 added the "//"

//       curl_setopt($curl, CURLOPT_SSLVERSION, 3); 

I've got a similar problem with ZenCart (v1.3.8). On the 24th Nov, changes made to upgrade from SSL3 to TLS1.2 protocol stopped transactions from working. The line above had been amended to change the "3" value to "TSLv1.0". This seemed to work.

But then the changes to Payment Express on the 1st of December to "upgrade their endpoint, replacing certificates from SHA-1 to SHA-2" has caused this to all stop working again. Panic! I haven't yet been able to get a response on this from Payment Express and am pursuing. My client is getting understandably concerned.

Any suggestions as to a fix for this issue?

Dan

[bislewl]

Try commenting out the line like I did. That is the recommended method.
see: http://www.zen-cart.com/showthread.p...yment-security

[umdiecker]

Try commenting out the line like I did. That is the recommended method.
see: http://www.zen-cart.com/showthread.p...yment-security

The change from curl_setopt($curl, CURLOPT_SSLVERSION, 3); to curl_setopt($curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1); originally worked for the upgrade from SSL3 to TLS1.2 protocol that occurred on the 24th Nov. But things failed again on 1st Dec for the upgrade to their endpoint replacing the certificates from SHA-1 to SHA-2.

So I have tried commenting out this line altogether as you suggested and it didn't work

I've even tried the sandbox URL provided by Payment Express to replace the original for testing - that doesn't work! I.e.
$this->_dpsPxpayUrl = 'https://sec.paymentexpress.com/pxpay/pxaccess.aspx';
//$this->_dpsPxpayUrl = 'https://www.dpsdemo.com/Sandbox.aspx?endpoint=pxpay2SEC';

This is getting really stressful, client is chasing to find out why their website isn't working [pulls out hair]. Any other ideas would be appreciated?

Payment Express suggested certificates to be changed to the new ones - to the best of my knowledge the web server does not have an SSL certificate (but has been working with Payment Express to date) - I assumed that was kinda the point of hosting your payment process externally? I assume if your web server doesn't have SSL certificate, you can't apply a certificate update to it (a stupid statement, I'm sure). https://www.paymentexpress.com/News/...SHA-1_with_SHA