6

Do I need to upgrade CiviCRM? Should I be concerned? I'm running CiviCRM 4.4.4.

See below:

This is a reminder email. If you have already taken action, please ignore this notification.

We’re contacting our merchants with some important information in response to an industry-wide security upgrade which is not unique to PayPal. This change involves upgrading Secure Sockets Layer (SSL) certificates over the course of 2015 and 2016. Our upgrade efforts for API endpoints are scheduled to start in June 2015.

Because these changes are technical in nature, we advise that you consult with your partner, website vendor, or individuals responsible for your PayPal integration. They will be able to identify what, if any, changes are needed. Please forward the information below to your technical contact for evaluation. We are here to help your technical contact work through this to ensure you continue to process payments through your current integration with us.

Full technical details can be found in our Merchant Security System Upgrade Guide. In addition, our 2015-2016 SSL Certificate Change microsite contains a schedule of our service upgrade plan.

Questions can be directed to our Merchant Technical Services team on our Technical Support website. Click here for more information.

  • As the answers below state - this isn't a security issue with CiviCRM itself. However, if you're running version 4.4.4, you ARE behind on security updates - consider upgrading to 4.4.19 or 4.6! – Jon G - Megaphone Tech Sep 1 '15 at 14:46
8

It seems it is about your ssl connection, so it's on the openssl layer connected to your webserver (apache or nginx).

Test your ssl connection with that site, https://www.ssllabs.com/ssltest/ it will tell you what needs to be improved.

In short, nothing to do with civicrm, but upgrading to the latest version is always a good idea anyway

  • Xavier - could you review my alternate answer below please? I'm pretty sure that's not what PayPal are saying here. – Chris Burgess Sep 11 '15 at 22:08
  • Re-reading their SSL microsite, I may be wrong - will update my replies if we get a response from PayPal. There's a related question now also with good input from DaveD. Everyone should just get SSL anyway. – Chris Burgess Sep 11 '15 at 22:49
5

This is a notice regarding BOTH your website's SSL, and the ability of CiviCRM to use your system PHP and SSL libraries to connect to Paypal's SSL.

SHA-256 support on your site

If you use SSL on your website, you need to check that your certificate is SHA-256. This can be done quickly using shaaaaaaaaaaaaa.com, and you can get a more thorough review from SSL Labs (check for SHA-256 support in the results).

Note that this will affect not just PayPal but also common browsers in the near future. This is not CiviCRM specific.

SHA-256 support in your hosting stack

If your PHP or cURL libraries are old, or your server's root CAs do not match the updated certificates Paypal are migrating to, you may experience issues with payment when they update.

Unless your hosting environment is shockingly outdated you're probably fine, but you should either test in advance that your hosting environment will handle the upgrade, OR be prepared for issues arising on September 30 when Paypal undertake their migration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.