No doubt a hopelessly naive question on HTTPS...

I'm really expecting a chorus of laughter here, but I really **had **been under the impression that I could take order payments online **without **an expensive SSL wotsit, because having chosen the payment method the customer was swiftly dragged off to my payment providers own SSL site where he did the dreaded deed with his credit card. But (at least for Google Checkout, my preferred provider) I think I was mistaken, since when I set up the sandbox account to test it out and entered the merchant info in my Admin >> Payment Modules, I spotted the following:
Select Merchant Calculation Mode of Operation
Merchant calculation URL for Sandbox environment. (Checkout production environemnt always requires HTTPS.)
Am I interpretting that gobbledygook right? I have to have an SSL certificate before I pass the customer on to Google Payments? Is that the case with the various PayPal alternatives too? There aint no method (other than them sending cheque in post) for customers to pay me **without **an SSL cert?
Apologies for being a bit thick here, and any answers gratefully received!

Yes, you are correct where Google Checkout concerned,
when in live mode..Have to have Google approved SSL Cert
i.e.
http://checkout.google.com/support/sell/bin/answer.py?answer=57856
PayPal Pro requires SSL, paypal express and IPN does not..
but as SSL certs are quite cheap now, best to purchase
and install one anyway..makes potential visitors feel secure
and shows that you are not setting up store on limited budget.
:smile:

Thanks for the quick reply. Strange, I'd always thought from memory that Google didn't work that way - I sold some raffle tickets from a non-SSL website a couple of years ago and could have sworn it was Google Payments I used, but obviously not! Whats the idea there, anyway - if the customer is whisked off to Google before giving payment details, what does my site need an SSL for anyway?

I briefly considered one of the PayPal flavours to accept payment but shied away given their seemingly extortionate rates, and to be honest I didn't entirely understand the difference between Pro, Express, and IPN anyway. Did look around for a tutorial on the differences, but didn't find one!

I've emailed our host for a quote for a certificate, but while waiting the requisite three days for a response from them (sigh...) whats your definition of "quite cheap"? :blush:

For an SSL that is google approved..around $US50
You would have to ask google why they require SSL
cert..suspect it is because there is a link to your site from
theirs and they want to make sure they are dealing with
who their participants say they are...their terms used
to be more competitive than paypal but now..no idea.
There is a comparison chart at paypal for differences
between options...paypal pro..you have to have ssl
and pay fee per month..it is £20.00 for UK..express
and IPN similar charges..IPN..client must fill in their
details into account on your site. ..express is similar to
Google..purchaser is sent direct to paypal to pay..
Neither of last 2 methods requires paypal account, if
you set up your own paypal account correctly.
Might be an idea to offer both paypal and google..
:smile:

Many thanks for that - that number doesn't sound anywhere near as bad as I expected, so I'll wait for my host to email me back with the quote of £300 :yes:
I'' certainly consider the idea of both PayPal AND Google Checkout though, it seems a sensible idea. What we need is some sort of tutorial on the various options available for payment and what they entail, and an estimate of cost per sale of £100 for example, so we can weigh things up properly rather than just stick our finger in the air to see which way the winds blowing!

P.S. Seeing your sig, have you heard the one about "Give a man a fish, and you feed him for a day. Give him a fishing rod, and he'll swap it for a fish"? :blush:

Sounds like you need a new host, regardless, if it takes them three days (or three hours) to respond. Mine charges $100 USD for a static IP and SSL certificate plus $35 installation, and that's high. Still pretty cheap, though, and a necessary cost of doing business.

Payment aside, a lot of people are leery of entering any personal info, including on the Create Account page, without the padlock.

It wouldn't be hard to put up a tutorial that spoke generally about payment processing options, but availability and costs depend so much on what country you're in, what products you sell, your creditworthiness, etc., that it would be so general it might not help much.

FWIW, my advice is to start right out with a proper credit card merchant account and forget PayPal and Google altogether, although it may depend on what you're selling, and to whom.

P.S. Seeing your sig, have you heard the one about "Give a man a fish, and you feed him for a day. Give him a fishing rod, and he'll swap it for a fish"?
Who said anything about giving him a fishing rod..
would have to buy his own...
:smartalec:

stevesh:

FWIW, my advice is to start right out with a proper credit card merchant account and forget PayPal and Google altogether, although it may depend on what you're selling, and to whom.

Non-essential goods, high disposable-income usually older customers, costing between £750 and £2,000. The cost of the cert. is negligible in real terms, so I'll do it anyway now I recognise what its for. We have EPOS now, so whats the deal with 'proper credit card merchant'?

Sorry, I had the impression you wanted to only accept Google Checkout.

I'm not sure how your EPOS works, but looking through the forums, it appears that you collect the credit card info via Zencart and then enter it manually into your EPOS system?

By 'proper credit card merchant account', I meant something like PayPal Website Payments Pro, Authorize.net, First Data, etc., where you pay a monthly fee and a percentage of sales, and your customers' CC details are sent to them for approval and processing.

Not at all - I **wanted **Google Checkout, because I've got a personal account there and thought it was quite handy, but I've not got it written in stone!
This is a brand new store, to partner an existing offline store, and its **there **that we have an EPOS terminal. From reading the forum posts over last few days I've seen that its certainly dangerous to take numbers from ZC and manually enter them on your EPOS, and **might **even be a breach of the T&C for the EPOS in the first place.

"where you pay a monthly fee and a percentage of sales, and your customers' CC details are sent to them for approval and processing". But I thought **that **was what Google Checkout did?! Damn, each time I revisit this I get more confused!

If you have an existing agreement with a C.Card clearing bank, it may be possible to link your ZC site to their payment gateway. Depending on what bank it is, there might even be a dedicated module in the free add-ons section.

I have heard that HSBC, for example, does have a script for ZC, but makes this available only to its clients. Your bank may have a similar arrangement.