This transaction is invalid - Paypal express

taliesin:

Has anyone got more information than what is on this thread. I am also getting the log messages indicating that "libcurl was built with SSL disabled, https: not
supported!"

I'm a little fuzzy on how the whole SSL certificate ties in to libcurl being compiled with SSL support. However in reading the CURL message, it doesn't sound like purchasing a certificate is going to do anything, since libcurl will still not have SSL enabled whether I have a certificate or not.

Another question is thus: Let's assume my hosting company fixes the libcurl minus SSL problem. Will I then need a certificate just to connect to PayPal's API?

CURL is used to communicate to PayPal.
That communication must be SSL-encrypted.
To do that requires that the server's CURL support (often libcurl) be compiled with SSL enabled ... which often requires that OpenSSL support also be compiled into PHP at the same time.
You should not require your own SSL certificate in order for this to work. The server's SSL support should handle it for you. However, even with that said, you should still consider SSL support for the purpose of protecting your clients' personal address information.

CURL is used to communicate to PayPal.
That communication must be SSL-encrypted.
To do that requires that the server's CURL support (often libcurl) be compiled with SSL enabled ... which often requires that OpenSSL support also be compiled into PHP at the same time.
You should not require your own SSL certificate in order for this to work. The server's SSL support should handle it for you. However, even with that said, you should still consider SSL support for the purpose of protecting your clients' personal address information.

Very helpful reply! :) I'm still a noob, however. ;)

This is what I need, minimally, to make this work:

1. OpenSSL needs to be installed.
2. cURL needs to be recompiled with SSL enabled (i.e. the make options need to point to OpenSSL, etc.)
3. Often, PHP must be compiled with OpenSSL support, as well.

Yes?

Now, you said something else that I'd like to ask for clarification on:

You should not require your own SSL certificate in order for this to work. The server's SSL support should handle it for you. However, even with that said, you should still consider SSL support for the purpose of protecting your clients' personal address information.

Now, the server's SSL support involves the server having a certificate with OpenSSL enabled?

Also, you said I should consider SSL support for the purpose of protecting my clients' personal information. I definitely agree. What do you mean by the statement that I should consider SSL support? Does that mean buying my own certificate? How do I implement that as separate from my hosting server's SSL support?

I've done many searches on this subject, but much of it is still going over my head. However, please don't despair. I work in IT, so I'm not completely unfamiliar with security protocols. (Just as they relate to web sites.) :)

Thank you.

taliesin:

What do you mean by the statement that I should consider SSL support? Does that mean buying my own certificate? How do I implement that as separate from my hosting server's SSL support?That's the job of your hosting company.
If you tell them you want to install an SSL certificate for your site, they may let you purchase one on your own, or may offer to purchase one for you.
Then they'll give you instructions on anything required of you. (ie: generate a CSR within your account) Sometimes they'll do that for you too. It'll be needed in order to purchase a certificate.
Then once purchased, you'll work with them to install that certificate into your account -- there are usually things to be done in your account and on the server in general ... it all depends on how they've configured it.
You'll also need a dedicated IP address in order for the SSL to work, so be prepared to pay an extra few dollars a month (hosting costs) for that if that's their policy.

You may find the specific steps for your hosting company in their FAQs.

Ah, ok. I believe I understand now.

After posting my reply, I went looking around on my Hosting Company's page, and they want $60/year for a SSL Certificate and $2/month + $10 setup for the static IP.

Considering some of the prices I've seen for Verisign and Thawte, etc., I'd say that's reasonable.

I also saw instructions on how to configure Zen Cart for SSL/HTTPS here: https://www.zen-cart.com/tutorials/index.php?article=14

So my understanding is that I ought to purchase the certificate and work with my hosting to get it installed. After I've gotten it purchased and installed, I'll follow the above instructions to have my customers' details protected. Yes?

Also, this all seems separate from my original PayPal problem, but to fix that, the hosting company needs to recompile their cURL with SSL support. Once THAT happens, cURL shouldn't have a problem. (Well, with SSL, anyways.)

Thank you for all your help, sir, and corrections on my misconceptions. :)

Sounds like you've got the right understanding.

Hi there, hope this is the right thread for this, just seems active so I hope to get an answer here.

I have zen 1.3.7 and the latest paypal express checkout module installed a few weeks ago. It seems to work ok, but I keep getting these debug emails from it in my email account,,, is it ok??? what are these emails?

You can turn the debugging off by going to Modules > Payment. Go to the PayPal express module, click "Edit" to edit the options, and turn off the debugging e-mails at the bottom of all the other options.

phil99:

Hi there, hope this is the right thread for this, just seems active so I hope to get an answer here.If the debug emails are saying "this transaction is invalid" then this is the right place. Otherwise a new topic would be most appropriate.

phil99:

I have zen 1.3.7 and the latest paypal express checkout module installed a few weeks ago. It seems to work ok, but I keep getting these debug emails from it in my email account,,, is it ok??? what are these emails?It depends on what those emails are saying.

taliesin is right - if you want to turn them off, just flip the switch.

If the debug-log setting is on "Alerts Only" then those emails are telling you that customers are encountering problems.

For what it's worth, I bugged my hosting company to recompile cURL with SSL support, and it worked marvelously! (To be fair, I didn't actually bug them...just asked, and they were very fast! lol)

For anyone who is wanting to see if their cURL is compiled with SSL support, you should be able to go to Zen Cart Admin > Tools >Server/Version Info

A little ways down the page, you should see a curl section. This is what mine looks like:

CURL support enabled
CURL Information libcurl/7.15.3 OpenSSL/0.9.7a zlib/1.2.1.2 libidn/0.5.6

It's easy to see that CURL has been compiled with SSL support from here.

Thanx to everyone who helped me get this up and running! Zen Cart's success has a great deal to do with these forums and the tremendous amount of help that is up there.

I'm working on getting my cart secured with an SSL cert now, and then I'll be good to go. Thank you again!