Is SSL mandatory now?

[barnyard1968]

Hello,

I've been informed that in upgrading from our current Zencart version using 'Paypal Website Payments' that we have to get our own SSL cert and cannot continue to use Paypal for v1.5

This seems incorrect - can anyone please confirm we can continue to use 'Paypal Website Payments'?

Thank you,
Barnyard.

[Kim]

Did that directive come from PayPal?

[RescoCCC]

There is nothing in version 1.50 that prevents you from using PayPal without an SSL cert.

That said, you should have one anyway to protect customer data during account creation, login, and checkout. Not having it on an eCommerce site is like putting up a big neon banner that flashes, "Warning: untrustworthy amateur!"

[DivaVocals]

PayPal Payments Pro cannot be used without an SSL certificate.. this is not required by ZEN CART, it's required by PAYPAL to use this particular payment product. PayPal Express still does not require an SSL certificate to use..

Hello,

I've been informed that in upgrading from our current Zencart version using 'Paypal Website Payments' that we have to get our own SSL cert and cannot continue to use Paypal for v1.5

This seems incorrect - can anyone please confirm we can continue to use 'Paypal Website Payments'?

Thank you,
Barnyard.

There is nothing in version 1.50 that prevents you from using PayPal without an SSL cert.

That said, you should have one anyway to protect customer data during account creation, login, and checkout. Not having it on an eCommerce site is like putting up a big neon banner that flashes, "Warning: untrustworthy amateur!"

[barnyard1968]

Thanks for your replies...

The answer matches my expectation that I would not need my own an SSL cert when using Paypal, ie I would use PayPal’s SSL cert.

[RescoCCC]

Depends on which version of PayPal you're using. If using PayPal Express, that's correct. You don't need your own SSL cert. But, again, you should have one anyway. Many buyers, (myself included), will hit the back button if the site is not secure during account creation, login, or checkout.

[DivaVocals]

Then let me make it CRYSTAL clear.. Because RescoCCC is right, simply saying "PayPal" without indicating WHICH PayPal module you are referring to is vague, and will give anyone following this thread the WRONG impression with regards to SSL certificates..

So let's make it clearer shall we??? (though I thought I HAD done that in my previous post ):

1. PayPal Website Payments Standard - IPN - SSL certificate is not required though it is STRONGLY recommended that you obtain one anyway. (please note that this method has been somewhat problematic in the past and PayPal Express Checkout is a more stable option to Payment Standard IPN.)
2. PayPal Website Payments Pro - SSL certificate IS REQUIRED by PayPal in order to use this service. PayPal also requires that PayPal Express Checkout is also activated as a payment option alongside of PayPal Website Payments Pro.
3. PayPal Express Checkout - SSL certificate is not required though it is STRONGLY recommended that you obtain one anyway.

Thanks for your replies...

The answer matches my expectation that I would not need my own an SSL cert when using Paypal, ie I would use PayPal’s SSL cert.

Depends on which version of PayPal you're using. If using PayPal Express, that's correct. You don't need your own SSL cert. But, again, you should have one anyway. Many buyers, (myself included), will hit the back button if the site is not secure during account creation, login, or checkout.

[schoolboy]

Thanks for your replies...

The answer matches my expectation that I would not need my own an SSL cert when using Paypal, ie I would use PayPal’s SSL cert.

Well... your site CANNOT use PayPal's cert.

Your site HAS TO use its own cert.

The reason why a cert is needed for WPP is that the PLACE where the credit card is being captured is on YOUR SITE... while with the other PayPal systems, it is on PAYPAL'S SITE.

But as my good and learned friend Resco says... using SSL is MUCH MORE than just having encryption for data transfer...

... it ALSO says to customers... "This is a professionally-run website, and we take your data privacy and security seriously, so we have OUR OWN SSL cert."

An increasing number of web shoppers WILL NOT SHOP on a site if it does not have its own SSL certificate.