Do I need SSL or not (I've read the FAQ but still not clear)

Hi all

I haven't pasted my full system details yet because I don't think it matters for this question.

I'm trying to figure out if I need to get an SSL certificate or not. I've read many posts, including the FAQ, on the matter but remain confused.

I've just upgraded from 1.5.1 to 1.5.4 and have found these PayPal Curl errors in my logs: (60) SSL certificate problem: unable to get local issuer certificate.

The curltester.php displays all the expected SSL errors and warnings.

So that seems obvious, however I never needed SSL before and no credit card info is stored on the website. The only payment provider is PayPal Express, same as we've had for years. Why would it need SSL only now, when apart from upgrading to 1.5.4 nothing else has changed.

I then found this thread and carried out the cacert.pem fix that it details:
https://www.zen-cart.com/showthread.php?213892-Curl-error-%2860%29-SSL-Certificate-problem-Unable-to-get-local-issuer-certificate

With that done, the curltester.php displays all good results.

But I remain confused - Is this now fixed or have I just applied some sort of pointless hack.. do I need an SSL certificate or not?

Thanks for any advice on this.
Regards
ROb

robax:

But I remain confused - Is this now fixed or have I just applied some sort of pointless hack.. do I need an SSL certificate or not?

Thanks for any advice on this.
Regards
RObYou will find LOTS of discussion here about this....

But for an investment of less than $15 per year why not just get one and move on to other things....

Thanks for the reply.

I'm referring to any absolute requirement for a certificate in order for the store to continue working as it has all long before version 1.5.4.

Whether one should have one or not in general is of course another question, and I'm happy with that. But does ZC 1.5.4 and PayPal Express work without SSL or not.. that is the question. 1.5.1 and all earlier versions were fine.

Regards
Rob

There's a diffence between the SSL used to access your site by customers and the SSL for your site to access other areas of the internet... The SSL needed to resolve this issue has nothng to do with the SSL of your customers accessing thsi site and typically is applied by your host without your involvement.

The queston of does the site need SSL? Yes, in order to securely apply CURL, but it is not required in order for a customer to access the site... This is covered n the system requirements (though perhaps not as openly as saying a SSL is required for the site to communicate usng other resources such as CURL): http://www.zen-cart.com/content.php?48-what-are-the-server-requirements-to-run-zen-cart

Not to hijack, but are you saying that this is a host level SSL?

lruskauff:

Not to hijack, but are you saying that this is a host level SSL?

There are 2 "levels"/"facets"/"parts"/"kinds" of SSL for a website:

I've written a post to explain these in more detail here: SSL Explained - Back and Front

Thank you.

Just to prove the point.

gilby:

You will find LOTS of discussion here about this....

But for an investment of less than $15 per year why not just get one and move on to other things....

Save your $15. Save the potential headaches and problems that can be caused by SSL. In spite of everyone's claims to the contrary, the only people that care about SSL are online merchants trying to convince other online merchants that it is a 'must have'.

One caveat. If your store accepts credit card payments directly (IOW, not via a 3rd party processor such as PayPal) - Then SSL is a legal requirement (along with a lot of other rules and regulations that 99% of merchants ignore anyway).

Cheers
RodG

Without an SSL cert, your admin credentials will be transmitted in clear text when you login. Your customer details will be transmitted in clear text when admin views orders. Your customer's credentials will be transmitted in clear text when they login.

Buying an SSL Certificate is part of running a serious legitimate business online. Even if you don't process cards on your site, you need to do it.

swguy:

Without an SSL cert, your admin credentials will be transmitted in clear text when you login. Your customer details will be transmitted in clear text when admin views orders. Your customer's credentials will be transmitted in clear text when they login.

Buying an SSL Certificate is part of running a serious legitimate business online. Even if you don't process cards on your site, you need to do it.

And in some parts of the world, like The Netherlands you are obliged by law to transmit those customer details in a safe way. The easiest way is by using an SSL Certificate.

AND..... The plot thickens on SSL. Any one been able to research the info at http://tinyurl.com/onys833? So far, we are not able to find anyone who is advertising SHA2 at any price. Has Google gotten in bed with Comodo, Trustwave, etc?

Good news for us. Looks like the CAs are recognizing Google's stand on SHA1 and offering free updates to SHA2. We'll see what that road turns out to be tomorrow.
Since we recently purchased a lot of 5yr certs, prayers ARE accepted.

dbltoe:

AND..... The plot thickens on SSL. Any one been able to research the info at http://tinyurl.com/onys833? So far, we are not able to find anyone who is advertising SHA2 at any price. Has Google gotten in bed with Comodo, Trustwave, etc?Off Topic: I assume you mean SHA256?
I recently had a number of sites reissued with SHA256
All new SSL's are SHA256 now??

swguy:

Without an SSL cert, your admin credentials will be transmitted in clear text when you login. Your customer details will be transmitted in clear text when admin views orders. Your customer's credentials will be transmitted in clear text when they login.

Buying an SSL Certificate is part of running a serious legitimate business online. Even if you don't process cards on your site, you need to do it.

Yes, Identity Theft is rife these days. So even you don't take CC details on your site and you use an external payment processor, it is still wise to install SSL and prevent customer details (name, address, user name, password etc) being filtered out and used as parts of the puzzle to construct a complete profile of any person.

gilby:

Off Topic: I assume you mean SHA256?
I recently had a number of sites reissued with SHA256
All new SSL's are SHA256 now??
Figured it wasn't off topic as I got there from DrByte's blog. Spell check changed from the 256.
Article states that Google will tell customers that the site is not secure if the SSL is not 256 and expires DURING 2016. No one else has gone that far. For those considering a purchase, they need to know that they are getting 256 simply because any cert purchased WILL expire either during or after 2016. Saying that all carts are 256 now is like saying all hosts provide the current PHP. Caveat Emptor.
The link in the blog post allows you to check your SSL and act accordingly.

Ok, so back to my thread...

I've read Dr Byte's post on SSL and that's clear but it still doesn't answer whether one needs to have a separate SSL certificate for the "background SSL/TLS core communications infrastructure" discussed there.

I didn't need one before, so I'm just asking if I need one now.... to recap my post:

I'm not using SSL for the store and from Dr Byte's post, I understand I can continue like that with the ZC 1.5.4 upgrade given my scenario of PayPal Express payments and nothing else. I'm perfectly happy with that.

However, after the 1.5.4 upgrade my store logged all these new Curl errors : "(60) SSL certificate problem: unable to get local issuer certificate."

I searched and then followed the suggestion in the post I linked:
https://www.zen-cart.com/showthread.php?213892-Curl-error-%2860%29-SSL-Certificate-problem-Unable-to-get-local-issuer-certificate

That post details how to download and setup a file "cacert.pem" which is a bunch of certificate code.

That successfully resolved the errors and I get a clean result from the curltester.

The question I posed was:

Is that an or the appropriate solution for the problem? I'm unclear on that partly because it seems like a weird fix.

Any advice on that particular point is appreciated.
Regards
ROb

robax:

Ok, so back to my thread...
I've read Dr Byte's post on SSL and that's clear but it still doesn't answer whether one needs to have a separate SSL certificate for the "background SSL/TLS core communications infrastructure" discussed there.

Unless you are managing your own server, lets just say "no" to this. :-)

robax:

I didn't need one before, so I'm just asking if I need one now....

No.

robax:

That post details how to download and setup a file "cacert.pem" which is a bunch of certificate code.

That successfully resolved the errors and I get a clean result from the curltester.

The question I posed was:

Is that an or the appropriate solution for the problem? I'm unclear on that partly because it seems like a weird fix.

Any advice on that particular point is appreciated.
Regards
ROb

Yes, it IS an appropriate solution for the problem.
Yes, it IS a weird fix.

Here's the deal... Your Hosting provider is a little behind in keeping their 'cacert's up to date. There are two solutions to this

1. Have the Hosting provider update the certs.
2. Install your own updated certs.

Most Hosting providers would have upgraded their certs before most users run into the problem.

You do not need any other SSL.

Cheers
RodG

RodG:

Yes, it IS an appropriate solution for the problem.
Yes, it IS a weird fix.

Here's the deal... Your Hosting provider is a little behind in keeping their 'cacert's up to date. There are two solutions to this

1. Have the Hosting provider update the certs.
2. Install your own updated certs.

Most Hosting providers would have upgraded their certs before most users run into the problem.

You do not need any other SSL.

Thanks Rod. That's exactly what I needed to know - Much appreciated as always!

The site seems to be running well now and especially the Couriers Please options in the upgraded OZPost seem to be very popular!
Regards
ROb

Aside from the "theoretical" and "technical" topics on SSL, a rapidly-growing number of people will now not shop on websites that do not default to https:// when the protocol is required or expected. So there is a MARKETING ADVANTAGE to having SSL, as it means MORE SALES.

We saw a 12% jump in sales when we actively promoted our site as having SSL, and explained to customers/visitors what it is, and why it is important... Part of our marketing strongly advised our visitors to AVOID non-SSL sites, because there is a real risk of data interception. It was interesting to see some of our competitors suddenly install SSL, and then (like us) advertise the fact.

Sometimes, you do what's necessary to be a better competitor. If your objective is to win as many customers and sales as possible, then you do what's expected, and what gives you a competitive advantage.

The only thing that concerns me is that if you are a potential competitor to me, then PLEASE DO NOT install SSL.... I'd rather your visitors leave your site and come and shop (safely) on mine. :D

schoolboy:

a rapidly-growing number of people will now not shop on websites that do not default to https:// when the protocol is required or expected.

Often claimed. Never proven.

I place this right up there with the "User Friendly URL's" - Same claims, never proven, and demonstrated time and time again that the majority of people don't even look at the URL's.

I still like to refer people to this site/study:

https://info.ssl.com/how-ssl-seals-boost-conversion-rates/

While the 'stats' are clearly with a purpose in mind (to sell SSL certs), I always find the most compelling factor for the stats isn't the SSL itself, but the public's perception, as stated by:

"While there is some correlation between a badge’s recognizability and performance, ultimately the simple inclusion of a seal somewhere on each page of one’s site (especially in the shopping cart) is enough to improve conversions".

In other words, if we realise/believe the studies that show that URL's (with or without 'https') are essentially ignored by customers, then this cannot be the driving force - The driving force being the site seals that 'tell' people SSL is in use (whether it is or not is a whole different matter).

Of the 60+ sites that we maintain, the two biggest sellers (both in excess of $250k sales per year), neither use SSL.

When one of these clients added SSL it had a significant drop in sales (which recovered when the SSL was removed). I can't/won't say for sure that the SSL was the cause of the drop/recovery - it may have been a seasonal coincidence not previously observed.

Neither this client, or myself are willing to repeat the experiment.

Cheers
RodG