Paypal Changes could break store
-
Hello
I received the following email a few days ago. Is WP ecommerce makeing the necessary changes to the plugin to make sure everything will work, or is this something each merchant is required to do? If we are required to do it, please help!
Global security threats are constantly changing, and the security of our merchants continues to be our highest priority. To guard against current and future threats, we are encouraging our merchants to make the following upgrades to their integrations:
1.Discontinue use of the VeriSign G2 Root Certificate
2.Update your integration to support certificates using the SHA-256 algorithmFor detailed information on these changes, please reference the Merchant Security System Upgrade Guide. For a basic introduction to internet security, we also recommend these short videos on SSL Certificates and Public Key Cryptography.
NOTE: The information below is in response to an industry-wide security upgrade and is not unique to PayPal. These updates will help secure your website’s interaction with the PayPal website and Application Programming Interface (API). Not all merchants are required to make these changes. Please ensure you are prepared for this event by consulting with your technology team, website vendor or individual(s) responsible for your PayPal integration.
VeriSign G2 Root Certificate Upgrade Timeline
In accordance with industry standards, PayPal will no longer accept secure connections that are signed by the VeriSign G2 Root Certificate.
Please note that the following rollout dates are subject to change. We recommend that you check back for updates.
February 18, 2015 – Complete
?api.sandbox.paypal.com
?svcs.sandbox.paypal.comFebruary 24, 2015 – Complete
?api-3t.sandbox.paypal.com
?api-aa.sandbox.paypal.com
?api-aa-3t.sandbox.paypal.comMarch 31, 2015
?pointofsale.paypal.comJune 19, 2015
?api.paypal.com
?svcs.paypal.comAugust 19, 2015
?api-3t.paypal.com
?api-aa.paypal.com
?api-aa-3t.paypal.comSHA-256 SSL Certificate Upgrade Timeline
PayPal is upgrading SSL certificates on all Live and Sandbox endpoints from SHA-1 to the stronger and more robust SHA-256 per the following timeline.
Please note that the following dates are subject to change. We recommend that you check back for updates.
February 18, 2015 – Complete
?www.sandbox.paypal.comMarch 4, 2015 – Complete
?pointofsale.sandbox.paypal.comMarch 19, 2015 – Complete
?cr.cybercash.comApril 8, 2015
?pilot-payflowpro.paypal.com
?pilot-plcc.payflow.paypal.com
?pilottbv4proxy.vps.paypal.com
?pilot-payflowprointernal.paypal.comJuly 8, 2015
?payflowpro.paypal.com
?payflowpro.verisign.com
?payflowprointernal.paypal.com
?plcc.payflow.paypal.com
?tbv4proxy.vps.paypal.comJuly 15, 2015
?cr-payflow.verisign.com
?payflow.verisign.comJuly 22, 2015
?vps-ipn.paypal.com
?tb-vps-ipn.vps.paypal.comSeptember 1, 2015
?pointofsale.paypal.comSeptember 15, 2015
?posprivatevpn.paypal.com
?posprivatevpn-api.paypal.com
?posprivatevpn-api-3t.paypal.com
?posprivatevpn-svcs.paypal.comQ1 2016 (Tentative)
?api.sandbox.paypal.com
?svcs.sandbox.paypal.com
?api-3t.sandbox.paypal.com
?api-aa.sandbox.paypal.com
?api-aa-3t.sandbox.paypal.comQ2 2016 (Tentative)
?api.paypal.com
?svcs.paypal.com
?api-3t.paypal.com
?api-aa.paypal.com
?api-aa-3t.paypal.comhttps://WWW.PAYPAL.COM – SSL Certificate Upgrade Timeline
PayPal is upgrading SSL certificates on https://www.paypal.com per the following timeline.
Please note that the following dates are subject to change. We recommend that you check back for updates.
March 23, 2015 – Complete
?www.paypal.com (intermediate change)September 30, 2015
?www.paypal.com (SHA-256)FAQs
Q. What is the SHA-256 rollout schedule?
To avoid service interruption, your clients must support SHA-256 by mid-2016.
Q. How do I know if my integration is affected?
We are making changes to the Sandbox environments prior to any Live changes, so you can verify your integration against the Sandbox. If you see these or similar error messages in the Sandbox environment, you will need to update your integration before we make changes to our Live environment (per the timeline above).
?“Unable to find valid certification path to requested target”
?“SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled”
?“alert handshake failure”
?“Problem with the SSL CA cert (path? access rights?)”Q. Do I need to update my SDK?
No, however, you may want to verify that you are using the latest version of your SDK. If not, follow the instructions provided to update your SDK. If you are not using a PayPal SDK, then you will need to contact your third-party provider for assistance.
Q. How do these updates affect the new optimized API endpoint (api-s.paypal.com)?
If you really want to future-proof your integration, try our optimized API endpoints – api-s.paypal.com (Live) and api-s.sandbox.paypal.com (Sandbox) – which already support G5 Trusted Root Certificates and SHA-256. For details, see the following overview and requirements.
Q: What is the status of PayPal Sandbox used for integration testing?
Currently, PayPal Sandbox endpoints have been upgraded to accept secure connections signed by the G5 Root Certificate. We will be modifying the Sandbox to use SHA-256 prior to upgrading the production environment to allow merchants ample time to test their integration. The date(s) surrounding this modification will be published when confirmed.
- The topic ‘Paypal Changes could break store’ is closed to new replies.
