Do I need purchase SSL license? The PxPay payment module cannot connect DPS gate way

I need HELPs!!!!!

I set up the website with zencart and installed the pxpay plugin to accept the credit card payment via DPS. But since lastw week, the PXpay module cannot connect to DPS gateway, everytime it say "The selected payment type is currently not available." I contacted DPS they said they can see there is no any issue at their side but they have disabled SSL 3.0 and only TLS will be available now. Also they will upgrade from SHA-1 to SHA-2 later.

Link as below:

https://www.paymentexpress.com/News/November_2014/Important_Change_Notice_-_SSLv3_0_Deprecation

and another:
https://www.paymentexpress.com/News/November_2014/Important_Change_Notice_-_Replacing_SHA-1_with_SHA

I contact my website hosting for helps but they said the issue is Signature algorithm SHA1 is weak and they will ugrade it to SHA2 but as its wildcard shared SSL and it will take time because many of their shared server didn't support SHA2 because of OS version so they can't deploy it yet. They are asking me to purchase a SSL license and also a dedicated IP. Total price will be $170 usd a year.

Is this charge reasonable? Why do we need a standard license for TLS ?

I am considering to change a new webhosting, but do your guys have any idea what kind of webhosting can work for DPS and no hassle in future? How can I indentify a plan will be working for us?

I know little about this kind of security information, Appriciate for any helps from your guys!!!

A SSL won't help it's an issue with the module.

I have modified the module to solve the issue, and should be uploading it soon.

I submitted the new version, should move through moderation by the ZenCart Team without issue

Awsome!!! is there any dowload link available at the moment?

Hi Bislewl, my guys solved the problem but many thanks for your help!!!

benxp:

Hi Bislewl, my guys solved the problem but many thanks for your help!!!

Hi,
i have just noticed that i have the same problem...
Can you point us in the right direction to solve this...?

00falcon:

Hi,
i have just noticed that i have the same problem...
Can you point us in the right direction to solve this...?

I updated the module http://www.zen-cart.com/downloads.php?do=file&id=658
Unfortunately I forked and did a merge request on github but before I posted it to Zen-Cart.com, the original author posted my commit to Zen-Cart.com.
So he got the credit :( At least the community will benefit, which is my overall goal

But all I did was:
in includes/modules/payment/dps_pxpay.php
Line 594 added the "//"

//       curl_setopt($curl, CURLOPT_SSLVERSION, 3);

bislewl:

I updated the module http://www.zen-cart.com/downloads.php?do=file&id=658
Unfortunately I forked and did a merge request on github but before I posted it to Zen-Cart.com, the original author posted my commit to Zen-Cart.com.
So he got the credit :( At least the community will benefit, which is my overall goal

But all I did was:
in includes/modules/payment/dps_pxpay.php
Line 594 added the "//"

// curl_setopt($curl, CURLOPT_SSLVERSION, 3);

I've got a similar problem with ZenCart (v1.3.8). On the 24th Nov, changes made to upgrade from SSL3 to TLS1.2 protocol stopped transactions from working. The line above had been amended to change the "3" value to "TSLv1.0". This seemed to work.

But then the changes to Payment Express on the 1st of December to "upgrade their endpoint, replacing certificates from SHA-1 to SHA-2" has caused this to all stop working again. Panic! I haven't yet been able to get a response on this from Payment Express and am pursuing. My client is getting understandably concerned.

Any suggestions as to a fix for this issue?

Dan

Try commenting out the line like I did. That is the recommended method.
see: http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security

bislewl:

Try commenting out the line like I did. That is the recommended method.
see: http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security

The change from curl_setopt($curl, CURLOPT_SSLVERSION, 3); to curl_setopt($curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1); originally worked for the upgrade from SSL3 to TLS1.2 protocol that occurred on the 24th Nov. But things failed again on 1st Dec for the upgrade to their endpoint replacing the certificates from SHA-1 to SHA-2.

So I have tried commenting out this line altogether as you suggested and it didn't work :(

I've even tried the sandbox URL provided by Payment Express to replace the original for testing - that doesn't work! I.e.
$this->_dpsPxpayUrl = 'https://sec.paymentexpress.com/pxpay/pxaccess.aspx';
//$this->_dpsPxpayUrl = 'https://www.dpsdemo.com/Sandbox.aspx?endpoint=pxpay2SEC';

This is getting really stressful, client is chasing to find out why their website isn't working [pulls out hair]. Any other ideas would be appreciated?

Payment Express suggested certificates to be changed to the new ones - to the best of my knowledge the web server does not have an SSL certificate (but has been working with Payment Express to date) - I assumed that was kinda the point of hosting your payment process externally? I assume if your web server doesn't have SSL certificate, you can't apply a certificate update to it (a stupid statement, I'm sure). https://www.paymentexpress.com/News/November_2014/Important_Change_Notice_-_Replacing_SHA-1_with_SHA

Have you tried commenting out ```php
curl_setopt($curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

Yes, I commented that out. It didn't seem to make a difference.

ok, I don't have a way to test this anymore. But after look at their sample code.

try replacing the current function with this.

    function &_initCURL($query) {
        $curl = curl_init();

        curl_setopt($curl, CURLOPT_URL, $this->_dpsPxpayUrl);
        curl_setopt($curl, CURLOPT_FRESH_CONNECT, true);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $query);
        if (defined('CURLOPT_POSTFIELDSIZE')) {
            curl_setopt($curl, CURLOPT_POSTFIELDSIZE, 0);
        }
        curl_setopt($curl, CURLOPT_TIMEOUT, 30);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false);
        curl_setopt($curl, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

        return $curl;
    }

I think that sort-of fixed the issue... I changed the $ch to $curl throughout (I assume it should be the same variable) and also added in the following line that was in the previous script and things seemed to resolve...

curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);

Is there any reason that this line should not be included? The prior function was:

function &_initCURL($query) {
$curl = curl_init();

    curl_setopt($curl, CURLOPT_URL, $this->_dpsPxpayUrl);
    curl_setopt($curl, CURLOPT_FRESH_CONNECT, true);
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, $query);
    curl_setopt($curl, CURLOPT_POSTFIELDSIZE, 0);
    curl_setopt($curl, CURLOPT_TIMEOUT, 30);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false);
    curl_setopt($curl, CURLOPT_HEADER, 0);
    //curl_setopt($curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

    if (strtoupper(substr(@php_uname('s'), 0, 3)) === 'WIN') {
        curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
    }
    return $curl;
}	

And is now:

function &_initCURL($query) {
    $curl = curl_init();

    curl_setopt($curl, CURLOPT_URL, $this->_dpsPxpayUrl);
    curl_setopt($curl, CURLOPT_FRESH_CONNECT, true);
    curl_setopt($curl, CURLOPT_POST, 1);
    curl_setopt($curl, CURLOPT_POSTFIELDS, $query);
    if (defined('CURLOPT_POSTFIELDSIZE')) {
        curl_setopt($curl, CURLOPT_POSTFIELDSIZE, 0);
    }
    curl_setopt($curl, CURLOPT_TIMEOUT, 30);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false);
    curl_setopt($curl, CURLOPT_HEADER, 0);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
    return $curl;
}

I copied their php sample code. Did that resolve the issues?

bislewl:

I copied their php sample code. Did that resolve the issues?

Seems to be working, many thanks!

umdiecker:

Seems to be working, many thanks!

Awesome, I'll resubmit the code to the forum then :)

umdiecker:

I think that sort-of fixed the issue... I changed the $ch to $curl throughout (I assume it should be the same variable) and also added in the following line that was in the previous script and things seemed to resolve...

curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false); ...
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);

Is there any reason that (these) lines should not be included? ...
Yes, you've basically disabled verification of SSL Certificates. If adding this line is the "fix" most likely: either the SSL Certificate at the payment gateway is BAD (very rare), the SSL Certificate at the payment gateway is not signed by a CA (rare), or your hosting provider does not have the appropriate CA certificates installed for cURL.