Zen Cart Logo
Forums / Built-in Shipping and Payment Modules / Question Re: POODLE SSL Vulnerability vs if I have no SSL certificate on my store

Question Re: POODLE SSL Vulnerability vs if I have no SSL certificate on my store

Views: 1,431

Results 1 to 5 of 5
15 Oct 2014, 11:13 PM
#1
vandiermen avatar

vandiermen

Totally Zenned

Join Date:
Feb 2007
Posts:
518
Plugin Contributions:
1

Question Re: POODLE SSL Vulnerability vs if I have no SSL certificate on my store

Hello,
Regarding: http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security
Question: Do I need to update if my website does not have SSL installed?

Also,
I tested one of my websites that has SSL and I was directed to the paypal website fine, no problem.
Question: Do I need to do the update anyway?
Also, could there be a problem with sending the payment receipt back to my website after purchase, that I am not seeing because I did not place an order.

15 Oct 2014, 11:25 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Question Re: POODLE SSL Vulnerability vs if I have no SSL certificate on my store

Yes, you should apply the change anyway.
The SSL used to broker the payment transaction takes place at a different level in your server and is not related to whether you bought an SSL certificate for your store or not.

15 Oct 2014, 11:29 PM
#3
vandiermen avatar

vandiermen

Totally Zenned

Join Date:
Feb 2007
Posts:
518
Plugin Contributions:
1

Re: Question Re: POODLE SSL Vulnerability vs if I have no SSL certificate on my store

probably I am not using SSL version 3 because checkout seems fine? and if I am not using version 3 I do not need to update?
I will check other websites to make sure checkout is going to paypay and that should tell me if I need to update?

15 Oct 2014, 11:30 PM
#4
vandiermen avatar

vandiermen

Totally Zenned

Join Date:
Feb 2007
Posts:
518
Plugin Contributions:
1

Re: Question Re: POODLE SSL Vulnerability vs if I have no SSL certificate on my store

p.s.
I just got your message and will update anyway.

15 Oct 2014, 11:43 PM
#5
vandiermen avatar

vandiermen

Totally Zenned

Join Date:
Feb 2007
Posts:
518
Plugin Contributions:
1

Re: Question Re: POODLE SSL Vulnerability vs if I have no SSL certificate on my store

Also I read

DrByte:

Sigh. It appears as though PayPal may have (temporarily) recanted their earlier aggressive block of all SSL3 connectivity to their live site, as connections are once again working fine (at this moment) using the original CURLOPT_SSLVERSION => 3 setting.

But they have stated that they will remove SSLv3 entirely very soon:
https://www.paypal-community.com/t5/...LE/ba-p/891829