Auth.net SIM Error 99 Cannot be accepted

[RixStix]

I almost posted this in the BUGS forum since Auth.net SIM does not seem to function in a fresh install of V1.5.3.

I realize that AIM is currently more attractive than SIM but on the next anniversary/renewal of our PCI certificate, v3 of the PCI documentation will be required by our processor. In the past, SAQ-C was required and the v3 rules will require SAQ-D for online merchants. To accept PayPal or credit cards via Auth.net SIM will require SAQ-A-ep which is ONE question short of SAQ-C v3. I really don't want to start on the 82 pages/340+ questions of SAQ-D, even if I could legitimately answer them all at this time.

That's why I just started setup SIM in our sandbox.

Auth.net credentials are currently functional in AIM and the same credentials are used in SIM, so that should not be an issue. The Auth.net response is greek to me and above my paygrade.

Assistance is appreciated.
Rick

zencart v1.5.3 fresh install
classic green template
No Plugins installed
sandbox PHP 5.3.28
sandbox MySQL 5.5.39-cll

Error 99: This transaction cannot be accepted.
Response Reason Code: 99

Response Reason Text: This transaction cannot be accepted.

Notes: Applicable only to the SIM API. The server-generated fingerprint does not match the merchant-specified fingerprint in the x_fp_hash field.
For security reasons, SIM requires the generation of a fingerprint hash, based on five values: amount, API Login ID, Transaction Key, timestamp and sequence number. (The sequence number can be set to the invoice number you generate for each order, or it may be randomly generated as long as it is a unique number that changes from one order to another.)
Issues with these values or with the generation process can cause Error 99. The three most likely causes of Error 99 are:

1) The Transaction Key that you have embedded in your script is not correct. Just to be sure, generate a new transaction key, disable the old transaction key, enter the new value in your script and test the connection.
To obtain the Transaction Key:

1. Log into your Merchant Interface at https://account.authorize.net.
2. Click Account from the main toolbar.
3. Click Settings in the main left side menu.
4. Click API Login ID and Transaction Key.
5. Enter your Secret Answer (the answer to your Secret Question configured at account setup).
6. To disable the old transaction key, click the check box labeled Disable Old Transaction Key.
(Note: If the Disable Old Transaction Key check box is not selected, the old transaction key will automatically expire in 24 hours.)
7. Click Submit to continue. Your new Transaction Key is displayed.

Please be sure to have your API Login ID and Transaction Key set in your scripts. When using PHP and ASP sample scripts, these fields must be filled out in your simdata.php or simdata.asp file, respectively. In the PERL sample script, it must be entered into the sim.pl script.
2) The amount has to be set in your scripting prior to the generation of the fingerprint hash. This usually means that the amount should be set in a previous form and posted to the script that generates the fingerprint hash.
3) You may not be properly posting all the required fields for SIM.

The following fields must be present in your payment form request in order for the transaction to be accepted:

1. API Login ID (x_Login)
2. The sequence number of the transaction (x_FP_Sequence)
3. The time when the sequence number was generated (x_FP_Timestamp)
4. The Fingerprint Hash (x_FP_Hash)
5. The amount of the transaction (x_Amount)

4) If you are attempting to pass the field x_currency_code with your payment form request, you must include this field in your fingerprint hash generation. Since Authorize.Net currently handles transaction amounts in the merchant's local currency by default, you may alternately stop passing x_currency_code.
For more information, see our Error 99 resolution tool at https://developer.authorize.net/resp...p?page_id=7199

Auth.net SIM myDEBUG logfile contents

Oct-31-2014 04:11:48
=================================

Sent to Authorizenet: Array
(
[x_login] => *******
[x_amount] => 34.03
[x_currency_code] => USD
[x_version] => 3.1
[x_method] => CC
[x_type] => AUTH_CAPTURE
[x_cust_ID] => 6858
[x_email_customer] => FALSE
[x_company] =>
[x_first_name] => Rick
[x_last_name] => MyLastName
[x_address] => MyStreetAddress
[x_city] => MyCityName
[x_state] => Louisiana
[x_zip] => 71301
[x_country] => United States
[x_phone] => BR549
[x_fax] =>
[x_email] => [email protected]
[x_ship_to_company] =>
[x_ship_to_first_name] => Rick
[x_ship_to_last_name] => MyLastName
[x_ship_to_address] => MyStreetAddress
[x_ship_to_city] => MyCityName
[x_ship_to_state] => Louisiana
[x_ship_to_zip] => 71301
[x_ship_to_country] => United States
[x_Customer_IP] => MyIPaddress
[x_relay_response] => TRUE
[x_relay_URL] => http://chainweavers.info/ZEN153/inde...action=confirm
[x_invoice_num] =>
[x_duplicate_window] => 120
[x_allow_partial_Auth] => FALSE
[x_description] => Website Purchase from ChainWeavers.com
[x_fp_sequence] => 163
[x_fp_timestamp] => 1414797108
[x_fp_hash] => 43ed4b08a86fd989bde3f290ebd8019c
[x_show_form] => PAYMENT_FORM
[x_receipt_link_method] => POST
[x_receipt_link_text] => Click here to complete your order.
[x_receipt_link_url] => http://chainweavers.info/ZEN153/inde...eckout_process
[x_Test_Request] => TRUE
[zenid] => fdc86827cb3a7b16343efe150ac76393
[url] => https://secure.authorize.net/gateway/transact.dll
)

[mc12345678]

For most likely correction see: http://www.zen-cart.com/showthread.p..._currency_code

[RixStix]

TNX mc12345678, I thought I had seen something recent but the search function didn't find it for me. Could have been out of frustration.

Making that change, gets one step further in the process, then receive the following screen (WITHOUT ANY DELAY). I tried commenting out the currency (lines 343/381) and also adding the code to line 385 (independently of each other). Results are identical.

The setting to REQUIRE CVV is set within the zencart SIM setup, though is not required when actually entering payment information.

An error occurred while trying to report this transaction to the merchant. An e-mail has been sent to the merchant informing them of the error. The following is the result of the attempt to charge your credit card.

This transaction has been approved.
It is advisable for you to contact the merchant to verify that you will receive the product or service.

Authorize.Net Merchant,

Your script timed out while we were trying to post transaction results to it.
Transaction ID: 0
Transaction Result: This transaction has been approved.

The following message was displayed to the customer:

No order is generated by zencart.

[RixStix]

The setting to REQUIRE CVV is set within the zencart SIM setup, though is not required when actually entering payment information.

This part resolved.
Requires additional configuration within the Auth.net account to allow VIEW, EDIT, and REQUIRE card code.

Still script timeout error.

In the meantime, work on css to make the auth.net SIM page have the same, or at least similar, appearance as our zencart pages.

[mc12345678]

What about the results of the curltester code found in the extras folder, extras/curltester.php?

Also, has the SSL3 been commented out as posted here: http://www.zen-cart.com/showthread.p...yment-security

Recommend the curltest first, the SSL change and then the curltest again after that... Then based on all reports to be able to offer a suggestion of further diagnosis.

[RixStix]

What about the results of the curltester code found in the extras folder, extras/curltester.php?

Also, has the SSL3 been commented out as posted here: http://www.zen-cart.com/showthread.p...yment-security

Recommend the curltest first, the SSL change and then the curltest again after that... Then based on all reports to be able to offer a suggestion of further diagnosis.

CurlTest => GOOD for both Auth.net production and sandbox servers.

No SSLv3 to comment in Auth.net SIM

Script timeout seems strange to me since the response is instant. I would have expected some delay in page update before receiving the auth.net white screen.

Next ???

Not a fan of SIM but also not a fan of SAQ-D for AIM either. SAQ A-ep is much more palatable for PayPal and SIM.

[mc12345678]

CurlTest => GOOD for both Auth.net production and sandbox servers.

No SSLv3 to comment in Auth.net SIM

Script timeout seems strange to me since the response is instant. I would have expected some delay in page update before receiving the auth.net white screen.

Next ???

Not a fan of SIM but also not a fan of SAQ-D for AIM either. SAQ A-ep is much more palatable for PayPal and SIM.

Okay, so details: has or doesn't have ssl3 to comment out, eh... :)

Made me think though. Sandbox is what is currently setup.. Is there an expectation that sandbox traffic will generate order ids in a cart? I've never actually used authorize.net nor tried to track down sandbox functionality within it, but just wondering if some portion of the communication has been "cut" to support sandbox mode. Afterall, it looks like the other changes have taken hold.

Cleared cache? And are you sure that there are no differences required between using all of the same credentials on two different "sites" using two different methods of processing (SIM/AIM)?

That's about as much as I've got at the moment

[RixStix]

Okay, so details: has or doesn't have ssl3 to comment out, eh... :)

No SSL version checks in SIM

Made me think though. Sandbox is what is currently setup.. Is there an expectation that sandbox traffic will generate order ids in a cart? I've never actually used authorize.net nor tried to track down sandbox functionality within it, but just wondering if some portion of the communication has been "cut" to support sandbox mode. Afterall, it looks like the other changes have taken hold.

From what I remember in the past, orders placed when Auth.net AIM in test mode are generated and stored the same as production.

Cleared cache? And are you sure that there are no differences required between using all of the same credentials on two different "sites" using two different methods of processing (SIM/AIM)?

Zencart setup instructions for AIM and SIM are identical as far as the steps for acquiring the credentials from the Auth.net account. Additional Auth.net SIM setup

• Auth.net SIM setup Response/receipt URL = default/blank
• Auth.net SIM setup Relay Response = blank
• Auth.net SIM setup Silent POST URL = blank

auth.net account set to LIVE. zc sandbox SIM set to test (test CC numbers) This is per zencart Auth.net SIM testing instructions. ZC in test but live auth.net does not required to be in TEST mode.

Once we get the sandbox working then we'll worry about issues that may be caused by a different php version used in our live site.

If I had any idea of what/when/where to look for the script that is giving timeout errors, I'd peek and poke around.

TNX for the suggestions so far.

[DrByte]

1. for the "99" error message, do: http://www.zen-cart.com/showthread.p..._currency_code

2. For Authorize.net setup instructions:
AIM: http://www.zen-cart.com/content.php?...payment-module
SIM: http://www.zen-cart.com/content.php?...payment-module

I've never had any difficulty switching between modules. Nothing special to do beyond what's listed in both of those articles.

[RixStix]

1. for the "99" error message, do: http://www.zen-cart.com/showthread.p..._currency_code

2. For Authorize.net setup instructions:
AIM: http://www.zen-cart.com/content.php?...payment-module
SIM: http://www.zen-cart.com/content.php?...payment-module

I've never had any difficulty switching between modules. Nothing special to do beyond what's listed in both of those articles.

Those are the instructions in my hands and both suggestions for use of the currency code have been tested independent of each other. Both currency code edits get past the first Hash error,

AIM is fully functional on our live site. SIM is being tested (unsuccessfully) on our sandbox site.

the error that exists now is the

Your script timed out while we were trying to post transaction results to it.
Transaction ID: 0

We would consider PayPal only for credit card processing instead of SIM except PayPal requires a PayPal account to process a credit card and there are quite a few customers that refuse to create a PayPal account.