QuickBooks Merchant Service

[cptok]

This is a very dangerous change. It has come up before in this thread and I DO NOT recommend anyone doing this. The reason that works is because you're stopping SSL cert validation (hence my original suggestion that you had SSL issue). To turn off that verification is a "hack" to make an incorrect SSL cert work anyway, and I do not recommend security eliminating hacks when dealing with credit card data. Do this entirely at your own risk - and accepting all potential consequences - but please do not recommend this as a solution to the QBMS crowd.

You are right however - this appears to be a Windows thing - so proper "fix" for this is to also use CURLOPT_CAINFO to provide validation info to curl.

[Del]

This is a very dangerous change. It has come up before in this thread and I DO NOT recommend anyone doing this. The reason that works is because you're stopping SSL cert validation (hence my original suggestion that you had SSL issue). To turn off that verification is a "hack" to make an incorrect SSL cert work anyway, and I do not recommend security eliminating hacks when dealing with credit card data. Do this entirely at your own risk - and accepting all potential consequences - but please do not recommend this as a solution to the QBMS crowd.

You are right however - this appears to be a Windows thing - so proper "fix" for this is to also use CURLOPT_CAINFO to provide validation info to curl.

Thanks for the suggestion of the proper fix.

The code change that was made
From:
curl_setopt($clientURL, CURLOPT_SSL_VERIFYPEER, 1);

To:
curl_setopt($clientURL, CURLOPT_CAINFO, 'c:\\Websites\\cert\\ca-bundle.crt');
curl_setopt($clientURL, CURLOPT_SSL_VERIFYPEER, 1);

This works correctly as far as I could tell, Again this for Window
servers.
Again I want to thank you for your help.

[cptok]

Thanks for the suggestion of the proper fix.

The code change that was made
From:
curl_setopt($clientURL, CURLOPT_SSL_VERIFYPEER, 1);

To:
curl_setopt($clientURL, CURLOPT_CAINFO, 'c:\\Websites\\cert\\ca-bundle.crt');
curl_setopt($clientURL, CURLOPT_SSL_VERIFYPEER, 1);

This works correctly as far as I could tell, Again this for Window
servers.
Again I want to thank you for your help.

Now that's a fix! Nice updated post - and great way to deal with the Windows issue of verifying peers. I may add that as a commented line for windows users to a new interim release. They will, as you did, have to make sure that have a ca-cert bundle and reference it correctly.

I am also thinking of updating the QBMS XML version - nothing serious as it does not use any of the enhanced XML functions - but nice to keep more/less current.

[thederrickm]

Searched through this thread but unable to find a resolution. I have setup and configured qbms on zencart 1.3.9h. I am getting the following error...

Validation Error: Please check your billing address and CVV code for accuracy and resubmit your transaction.

However when I check my credit card, I have been charged the amount. So customers are being charged but no order is recorded. Please help.

[thederrickm]

Looking at my account again I see the transaction then right above it I show a credit - like it was charged then reversed.. hmmm

[cptok]

Interesting situation. One real key here is that your card has not been charged (contrary to your original post). That would have been of real concern. The message you are getting can ONLY be generated by one return code from the QBMS server. That particular code means one of the following occured at the server:

Incorrect Card Verification Code
Incorrect Zip Code
Incorrect Street Address
Incorrect Street Address and Zip Code
Card Verification Code not available
Street Address and/or Zip Code not available

I have a recollection of someone else having a similar issue way back... and the solution was for them to carefully review their "security" settings on their account at QBMS. If you have changed the defaults - then the charge may be rejected (although initially approved according to defaults). Can you check those? If you have very strict security requirements, above and beyond the default QBMS settings on the account, you may see this behavior.

I don't remember off the top of my head what the default is - but it does allow one to be wrong (such as zip) but not two (such as zip AND CVV). That is, in my opinion, the source of the issue. If that is the case, then this isn't an issue with the module - as it's correctly reporting the return codes from QBMS - but rather the sort of strange way that QBMS handles rejections based on non-default security settings.

Make sense?

[joshuagodinez]

I'm a customer service agent at Intuit. For the type of account (e-commerce or web store are the names we use) that works with zen cart you have the ability to refuse to process any transaction that fails to verify the billing address or the 3 digit code from the back (called CCV, CVV, among other TLA's).

You could have your zen cart or your Intuit e-commerce (or both) settings to refuse transactions that don't pass the address or CCV check. The way that is shown in your processing is the sale goes through (it's approved) and then immediately the system sends a void to back out the transaction that was just approved.

The merchant service center is where you would control your Intuit settings for this (merchantcenter.intuit.com). When you log into your account you can change those settings on the account menu. It's recommended you require everything to pass before accepting the transaction because web sales are notorious for fraud.

I hope that helps. :)

Joshua R. Godinez
Merchant Services Representative, Intuit
[email protected]