PayPal SHA-256 Security Update Sept 2015

[honrheart]

I just saw where you said if they used shared certificates so then are you saying they WILL need the private SSL as HostGator mentioned in their second response?

[DrByte]

I just saw where you said if they used shared certificates so then are you saying they WILL need the private SSL as HostGator mentioned in their second response?

That is how I read what hostgator is saying to you about hostgator accounts, yes.

[honrheart]

That is how I read what hostgator is saying to you about hostgator accounts, yes.

Ok here's the latest and this makes it sound as if the SSL is more of a benefit than a requirement. Most of the store owners I know have SSL turned off:

My question to them:

One final question before I decide how to proceed. Does it matter either way if we do not have SSL enabled on our stores? We use Zen Cart and you are given the option to enable the SSL or not. Most of the stores in my industry have it set to false and I was wondering if that makes any difference whether or not we would need the private SSL or not. I don't want to tell people they MUST have it if it's not necessary. I know a previous update said you would be ready for the Apache/OpenSSL part of Paypal's new changes but if we have SSL turned off in our stores why do we need to purchase a PrivateSSL certificate?

Their Reply:

It is true that you do not need an SSL installed to run an online store. Not having one installed increases the risk of client personal information (account log in or credit card/PayPal account details) being stolen as there is no secure login or cart checkout without an SSL. So installing an SSL is a security service to protect client information as well as a safety perception for your clients (they see the https in the address or the SSL site seal and feel more secure in their transactions on your site - which is a reality and not just a perception) that will bring more sales over not having an SSL. So installing an SSL is more of a benefit in these regards. I hope this helps.


*****

I know having a SSL is a great benefit but what these store owners want to know is if it's a requirement for their stores to run with paypal's new changes. HostGator is ready for the Apache/OpenSSL but it appears as if the privateSSL is only requirement if customers have SSL enabled, if not then it's just a suggestion but their stores will run fine without. Is that how you see it?

[DrByte]

I know having a SSL is a great benefit but what these store owners want to know is if it's a requirement for their stores to run with paypal's new changes.

Sigh.

No, having a private SSL certificate on your domain is NOT a requirement for a Zen Cart store to operate with PayPal Express Checkout, including the Summer/Fall 2015 SHA-256 changes PayPal is making.

But a storeowner who is serious about customer engagement and customers feeling comfortable shopping there and that the storeowner actually cares about their security will happily install a private dedicated SSL certificate to their store. The annual cost of a private SSL certificate is so low nowadays that there's very little justification to not do it.

[amperial]

A new letter from PayPal today:


The following are technical changes that may require some upgrades to your system. Please share this information with your development team or hosting provider.


Now
Test Sandbox endpoints and tlstest.paypal.com are live.


New SFTP IP addresses are live.

Sandbox is issuing API Credential Certificates with new standard (2048-bit, SHA-256).

Jan 14, 2016
After this date, Sandbox API endpoints only support new standard (HTTP/1.1, TLS 1.2 and SHA-256 certificates).

This includes www.sandbox.paypal.com only accepting HTTPS for IPN Postbacks.

Jan 31, 2016
Production starts issuing API Credential Certificates with new standard (2048-bit, SHA-256).

Feb 29, 2016
Test Sandbox endpoints will be removed.

Mar 17, 2016
New SFTP IP addresses add to DNS for reports.paypal.com.

Apr 14, 2016
Old SFTP IP addresses removed from DNS for reports.paypal.com.

May 12, 2016
Old SFTP IP addresses stop working.

Jun 17, 2016
After this date, Production API endpoints will start moving to the new standard (HTTP/1.1, TLS 1.2 and SHA-256 certificates)

Sep 30, 2016
IPN postbacks to www.paypal.com only allow HTTPS

Jan 1, 2018
All Certificate API Credentials must have been upgraded to the new standard.

[Ajeh]

There will be only a couple VERY MINOR changes needed to Zen Cart (and will be included in v1.5.5) ... but you WILL need to work with your hosting company to ensure your server is capable of the modern TLS 1.2 security communications requirements.

[buildingblocks]

There will be only a couple VERY MINOR changes needed to Zen Cart (and will be included in v1.5.5) ... but you WILL need to work with your hosting company to ensure your server is capable of the modern TLS 1.2 security communications requirements.

will these changes be available as patches for existing carts?

[wilt]

Hi,

That is the intention. :)

will these changes be available as patches for existing carts?

[buildingblocks]

:) Thanks

Hi,

That is the intention. :)

[kobra]

will these changes be available as patches for existing carts?

I am pretty certain that this depends upon what version of ZenCart you are using
Refer to the support doc here
https://www.zen-cart.com/showthread....ort-Life-Cycle