SSL needed for PayPal / no SSL for cc ?

A few questions:

(i) Does PayPal require that one uses SSL? I know that one should, but getting it going or changing hosts can be a lot of work and expensive.

(ii) Anyone know of a cc payment module/company that has a "secure" payment procedure without SSL?

(iii) Any known sequrity concerns with the built in credit card module in Zen-Cart? Anyone using it who has comments/experience?

All input appreciated.

1. The SSL is at the Paypal end where the transaction takes place.

2. Yes - #3!

3. Not as far as I'm aware.

BUT you really should consider that the shopping population on the 'net is becoming more aware, and the lack of SSL when they're supplying you with personal details will be a deterrent.

There are some costs you really have to accept if you want to make a go of your business....SSL is one of them. It also helps you look professional.

The personal details that are being given to you by the customer when you are using Papal are no more sensitive than what can be found in the phone book. SSL slows down your cart considerably. The default setting in most browsers, is to not have anything cache from secure pages. The encryption causes everything in the browser to run like cold honey. The big problem is that your average user doesn't understand this (well apparently not many tech support people either) so you have to point this out in a friendly and short paragraph. Don't get suckered into an SSL cert if you don't have to. My host charges $25.00 just to install one if I already have it.

Adaire:

The personal details that are being given to you by the customer when you are using Papal are no more sensitive than what can be found in the phone book. SSL slows down your cart considerably. The default setting in most browsers, is to not have anything cache from secure pages. The encryption causes everything in the browser to run like cold honey. The big problem is that your average user doesn't understand this (well apparently not many tech support people either) so you have to point this out in a friendly and short paragraph. Don't get suckered into an SSL cert if you don't have to. My host charges $25.00 just to install one if I already have it.
While there's some truth to your comments, look at it from another angle... security is your friend when it comes to e-commerce. If customers don't feel secure, they won't buy. If you aren't protecting data and you end up with any sort of lawsuit, you don't have much to stand on. Gosh, an SSL certificate doesn't have to be expensive, nor does the installation or hosting related to it. By all means, don't pay more than you have to, but don't skimp on security just to save a couple bucks. Besides, you can write it off as an expense anyway. It'll save you in the long run .... and, depending on what you're selling and who you're selling to, it'll MAKE you more sales, which theoretically should MAKE you more money...

By the way, check out the laws in your geographic region and the regions where your customers come from, to determine whether there are legal requirements for protecting customer data. And, state ALL the details of your privacy policy ON your site. If you are protecting customer data, say so. If you're not, say so. Or at least get your attorney to write up the politically correct wording. (That'll cost a ton more than an SSL certificate, by the way.)

was reading this and another point on SSL certification is that you CAN make your own SSL certificate for free and SSL will work perfectly although it will warn the customer that the certificate is not from a "PAID FOR" issuer. Advise is to post on your site information telling the customers that you are the creator of the certificate. I have done this for years and tell the customers that I do NOT BELIEVE in paying someone for the certificate when I can do such a simple thing for free. I run STunnel on my sites. Get all the details and the program from their website at http://www.STunnel.org
:D

and while what you are saying about a self signed cert is true,
its really amazing how fast people hit the close button when that warning popups, up.

I get secure page warnings and pack up my credit cards and go home ... :eek:

No SSL , No Sale. Think of it as the electronic version of a prophylactic :thumbsup:

Gerard :smile:

Have made plenty of sales. I use PayPal. Their cert is paid for. Mine is for my site only and I do not accept credit cards or payments directly on my site at all.:thumbsup:

I didnt say it wasnt secure,
I just know for a fact that popups scare people,

I really dont understand people not buying one at all, they cheap and dont cost a lot.
Its not much to ask for really.

As for SSL slowing your cart down, yes it very well might do by a few milliseconds on the secure pages but its well worth it in my opinion.

Reesy:

I really dont understand people not buying one at all, they cheap and dont cost a lot.
Its not much to ask for really.

It depends on where you buy your certificate and what their requirements are. I just visited Versign and their price is $399 certainly not cheap in my book.

On the other had I bought a Comodo cert for a client and while it was only $90 they also required my client to fax them her business license and EIN paperwork to prove she was the owner of the business / domain she was wanting to install the certificate on.

I don't have ssl set up on my site yet but I agree with the reasoning for having one and will be looking closer at my options in the near future. If anyone has any reputable and "cheap" sites for purchasing I would be interested in them.

Verisigns certs are no better than anyone elses your just paying for the name.
For what its worth I use Geotrusts but you can get SSLs for free if you look, and your host probably has a shared cert you can use for nothing (although not the best option IMHO).

There are a number of suggestions, as well as philosophical discussions on the topic in this archived thread:
http://www.zen-cart.com/forum/showthread.php?goto=lastpost&t=24902

Yes Reesy I know that I can use my shared ssl but I am looking to not do so - I am looking for quality SSL that isn't going to pop up with warnings - I happen to agree with Linda - I see an SSL warning on a site and I leave without even entering the site. I do not want any warnings when I make this change ;)

Thanks for the info though - I will look into Geotrust as well.

Dr. Byte :) Thanks for the archive link - more reading and absorbing for me.

At the end of the day Tina, theyre all the same thing with a different badge on the front, and you will not get any pop up warnings if its set up correctly and not a self cert.
You pays your money and takes your choice.
Good luck.

this is true reesey,

while
https://www.camelot-hosting.com/~username
is just as secure as
https://www.domain.com
its a matter of astetics,

the first ( Shared SSL ) gives the impression of going to a new url.

See when I use my hosts shared ssl I get the "not trusted signer" warning in IE - in firefox it just goes straight to the lock.

I will buy and install my own when I am doing the 500 other things that I need to finish to make my site "complete" :)

Thanks for the info Reesy, Tony, and Dr. Byte - I have a lot of reading in front of me but I believe that I know better now where I will be purchasing my certs at :)

Hate to ask who you are hosting with ... :eek:

Have them check your site is setup right ... that is really bad business to get warnings like that ...

Hi
Just came accross this looking for installing Zencart on ssl.

I bought a SSL Yesterday, this was how!

1. I have a cpanel host
2. Created a subdomain (secure.mydomain.com)
3. I bought a Static IP Address for $2 a month
4. I went to http://www.positivessl.com (I have no association to them)
5. Started to fill out the purchase form at say 4pm.
6. Created a private key in cpanel SSL Manager, then created a CSR in cpanel
7. pasted the CSR (encrypted text) into the form (5.)
8. received a email to my domain, clicked the validation link
9. received another email with 2 files attached.
10. back to cpanel, pasted my certificate, private key and bundle file (encrypted text) into the SSL Installer.

4.20pm all done, now have https://secure.mydomain.com 128bit in IE and 256bit in Opera and Firefox.

The SSL is a Comodo based cert, Comodo are one of the biggest suppliers.

The best thing is my host wanted £75 for the cert and install, I did it myself for £11.75 - $22 in 15-20 minutes....