6

Recently, our client got an email from PayPal regarding their service upgrade. I know about the SSL upgrade which took place around December 2014 due to poodle attack

I am unaware about this new upgrade, also i don't know if it will affect the payments on Magento website.

I read the documentation for System Upgrade provided by them. It suggests changes in the API and other stuffs. But i am not sure if these changes will affect Magento - PayPal integration.

If yes, will there be any upgrade patch released? I am sure, till now there is no upgrade patch released.

The mail my client received is as below:

PayPal service upgrades for merchants: You may need to take action.

We're contacting our merchants with some important information in response to an industry-wide security upgrade, not unique to PayPal. This change involves upgrading Secure Sockets Layer (SSL) certificates over the course of 2015 and 2016.

Since these changes are technical in nature, we advise you to consult your partner, website provider, or the people responsible for your PayPal integration. They will be able to identify if any changes will be needed. If you don't have a technology team, you should change this, and we can work with them to ensure that you continue to process payments through your current integration with PayPal. Full technical details can be found in our Merchant Security System Upgrade Guide. In addition, our 2015-2016 SSL Certificate Change microsite contains a schedule of our service upgrade plan.

If you have any questions, please contact our Merchant Technical Support team for technical support.

Thanks for your patience as we continue to improve our services.

It would be of great help, if someone can provide an insight on it.

EIDT

Our client got another email regarding it. The mail content is as below:

As we have previously communicated to you, PayPal is upgrading the certificate for www.paypal.com to SHA-256. This endpoint is also used by merchants using the Instant Payment Notification (IPN) product.

This upgrade is scheduled for 30/9/2015; however, we may need to change this date on short notice to you to align to the industry security standard.

You’re receiving this notification because you’ve been identified as a merchant who has used IPN endpoints within the past year. If you have not made the necessary changes, we urge you to do so right away to avoid a disruption of your service!

Because these changes are technical in nature, we advise that you consult with your individuals responsible for your PayPal integration. They will be able to identify what, if any, changes are needed. Please share this email and the hyperlinks below with your technical contact for evaluation.

Testing in the Sandbox is one of the best ways to make sure your integrations work. Sandbox endpoints have been upgraded to accept secure connections by the SHA-256 Certificates.

Full technical details can be found in our Merchant Security System Upgrade Guide. In addition, our 2015-2016 SSL Certificate Change microsite contains a schedule of our service upgrade plan.

Thanks for your patience as we continue to improve our services.

I am really confused if this in any way effect the integration of PayPal Standard or Express checkout with Magento. I am not a server expert to figure it out.

Can anyone please provide an insight on it.

4

I got this too. You're probably looking at this blog article, right? https://devblog.paypal.com/paypal-ssl-certificate-changes/

The translation is that they're going to use SSL certificates which have stronger encryption on them. All you need to do is make sure your server supports it. Which means - ask your hosting provider.

You actually shouldn't have to do anything in Magento itself. This is all server-level material. Magento itself doesn't actually do the encryption/decryption, it makes a call to the server which handles that.

To be 100% certain, call your hosting provider about this. Tell them that you got this email about paypal upgrading their SSL certs to SHA-256, and you want to make sure your server supports it.

Most likely, they'll tell you they upgraded months ago.

  • does that mean a Magento site will need SSL certificate from Sep 30th? – JohnyFree Sep 17 '15 at 18:44
  • Nope. From our perspective, everything's the same as it was before. It's just that when your server communicates to paypal for a purchase, that connection between the two systems will be using a stronger encryption. (That said, getting an SSL is generally a pretty good idea.) – SamC Sep 17 '15 at 19:22

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.