API certificate upgrade

[harry2cool]

Got an email from PayPal for us to perform action on 2 things:

https://www.paypal.com/in/webapps/mp...nt-api-upgrade

https://www.paypal.com/in/webapps/mp...fication-https

We use v1.5.4 , does this affect us.

We are using https on our payment and checkout pages for sure, do not understand about the certificate.

Please guide.

Thanks

[carlwhat]

check your website using:

https://www.ssllabs.com/ssltest/

if ssllabs reports no problems, you should be good....

[mc12345678]

Got an email from PayPal for us to perform action on 2 things:

https://www.paypal.com/in/webapps/mp...nt-api-upgrade

https://www.paypal.com/in/webapps/mp...fication-https

We use v1.5.4 , does this affect us.

We are using https on our payment and checkout pages for sure, do not understand about the certificate.

Please guide.

Thanks

With regards to the certificate, that is something that pretty much relates to your account and the information to be communicated between paypal and your store. Ie. When the store says: hi, my credentials are these, does paypal say, yup they match or sorry, those don't look right. In otherwords the data that is entered into ZC as provided by paypal related to the API credentials. That is at least in relation to the first link that was posted.

The second link has to do with communication from your server to paypal and has nothing to do with whether your store currently has an SSL certificate to support customer information being encrypted between their computer and the store.

[lat9]

The way I read the first PayPal notification:

The API certificate credentials issued by PayPal for use with the Classic API are being upgraded to SHA-256 signed 2048-bit certificates. If you currently connect to PayPal using API certificate credentials, you will need to generate a new API certificate via your account profile and use it for all API requests.

... is that any shop using PayPal Express Checkout (including PayPal Payments Pro, since PP-ec is a pre-requesite) needs to log into their PayPal Merchant Center and re-generate their API credentials by January 1, 2018, storing the results in their store's PayPal Express Checkout configuration.

[dbltoe]

Directions for upgrading API are available at https://www.paypal.com/us/selfhelp/a...chAutoComplete but (shock) are not quite correct. Below is our version for Express Checkout.

1. Log in to your PayPal account. You may need to go to Account Summary to show Profile in the upper-right
2. Under Profile, select Profile and settings.
3. Click My selling tools.
4. in the API access section, click Update.
5. Scroll down to NVP/SOAP API integration (Classic) and click on Manage API credentials.
6. You should now be at the View or Remove API Signature page. If you already use API credentials, you will see a large, blue, Remove button.
7. Click on the Remove button to remove and click it a second time to confirm the operation.
8. Scroll down to the NVP/SOAP area and click on Manage API credentials.
9. Make sure the Request API signature radio button is selected.
10. Clcik the Agree and Submit button.
11. Click the show link next to each item and replace the old with the new in Zen Cart. ** The username should be the same.
12. Update the PayPal changes and you're done.

[dbltoe]

Just a followup to let everyone know that the new API information works.

[frank18]

One of my clients received an email from PayPal re upcoming security upgrades (similar to issues posted in this thread already)

Pls see:

https://www.paypal.com/au/webapps/mp...nt-api-upgrade

https://www.paypal.com/au/webapps/mp...fication-https

https://www.paypal.com/au/webapps/mp...ion-get-method

and finally:

https://www.paypal.com/au/webapps/mpp/tls-http-upgrade

This is no problem as the server is geared for TLS 1.2 anyway.

I am pretty sure that ZC is set for all of these requirements anyway but thought I post them here for comments etc etc.

Some points have been covered here already.

Cheers / Frank